set $block_user_agent 0;
if( $http_user_agent ~"Wget|AgentBench"){
set $block_user_agent 1;
}
if($block_user_agent =1){
return403;
}

location ~*"\.(sql|bak|zip|tgz|tar.gz)$"{
return404
}

cd /usr/local/src
wget http://nginx.org/download/nginx-1.9.4.tar.gz
wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.37.tar.gz

wget http://luajit.org/download/LuaJIT-2.0..tar.gz
wget https://github.com/simpl/ngx_devel_kit/archive/v0.2.19.tar.gz
wget https://github.com/openresty/lua-nginx-module/archive/v0.9.16.tar.gz

useradd -s /sbin/nologin -M www

tar zxvf v0.2.19.tar.gz
tar zxvf v0.9.16.tar.gz

tar zxvf LuaJIT-2.0.3.tar.gz
cd LuaJIT-2.0.3make && make install

环境变量
export LUAJIT_LIB=/usr/local/lib
export LUAJIT_INC=/usr/local/include/luajit-2.0

tar xf nginx-1.9.4.tar.gz
cd nginx-1.9.4
./configure --prefix=/usr/local/nginx --user=www --group=www --with-http_ssl_module --with-http_stub_status_module --with-file-aio --with-http_dav_module --add-module=../ngx_devel_kit-0.2.19/--add-module=../lua-nginx-module-0.9.16/--with-pcre=/usr/local/src/pcre-8.37make && make install
ln -s /usr/local/lib/libluajit-5.1.so.2/lib64/libluajit-5.1.so.2    #一定创建此软连接，否则报错

location /hello {
default_type ‘text/plain‘;
content_by_lua ‘ngx.say("hello,lua")‘;
}

/usr/local/nginx-1.9.4/sbin/nginx –t
/usr/local/nginx-1.9.4/sbin/nginx

yum install -y readline-devel pcre-devel openssl-devel

cd /usr/local/src
wget https://openresty.org/download/ngx_openresty-1.9.3.2.tar.gz
tar zxf ngx_openresty-1.9.3.2.tar.gz
cd ngx_openresty-1.9.3.2./configure --prefix=/usr/local/openresty-1.9.3.2--with-luajit --with-http_stub_status_module --with-pcre --with-pcre-jit
gmake && gmake install
ln -s /usr/local/openresty-1.9.3.2//usr/local/openresty

vim /usr/local/openresty/nginx/conf/nginx.conf

 server {
      location /hello {
                      default_type text/html;
                      content_by_lua_block {
                      ngx.say("HelloWorld")
                            }
                   }
}

/usr/local/openresty/nginx/sbin/nginx -t
/usr/local/openresty/nginx/sbin/nginx

git clone https://github.com/unixhot/waf.git
cp -a ./waf/waf /usr/local/openresty/nginx/conf/

#WAF
lua_shared_dict limit 50m;              #防cc使用字典，大小50M
lua_package_path    "/usr/local/openresty/nginx/conf/waf/?.lua";
init_by_lua_file    "/usr/local/openresty/nginx/conf/waf/init.lua";
access_by_lua_file  "/usr/local/openresty/nginx/conf/waf/access.lua";

/usr/local/openresty/nginx/sbin/nginx –t
/usr/local/openresty/nginx/sbin/nginx

mkdir /tmp/waf_logs
chown nginx.nginx /tmp/waf_logs

cd /usr/local/nginx/conf/waf
cat config.lua
--WAF config file,enable ="on",disable ="off"
--waf status
config_waf_enable ="on"                                   #是否开启配置
--log dir
config_log_dir ="/tmp/waf_logs"                           #日志记录地址
--rule setting
config_rule_dir ="/usr/local/nginx/conf/waf/rule-config"  #匹配规则缩放地址
--enable/disable white url
config_white_url_check ="on"                              #是否开启url检测
--enable/disable white ip
config_white_ip_check ="on"                               #是否开启IP白名单检测
--enable/disable block ip
config_black_ip_check ="on"                               #是否开启ip黑名单检测
--enable/disable url filtering
config_url_check ="on"                                    #是否开启url过滤
--enalbe/disable url args filtering
config_url_args_check ="on"                               #是否开启参数检测
--enable/disable user agent filtering
config_user_agent_check ="on"                             #是否开启ua检测
--enable/disable cookie deny filtering
config_cookie_check ="on"                                 #是否开启cookie检测
--enable/disable cc filtering
config_cc_check ="on"                                     #是否开启防cc攻击
--cc rate the xxx of xxx seconds
config_cc_rate ="10/60"                                   #允许一个ip60秒内只能访问10此
--enable/disable post filtering
config_post_check ="on"                                   #是否开启post检测
--config waf output redirect/html
config_waf_output ="html"                                 #action一个html页面，也可以选择跳转
--if config_waf_output ,setting url
config_waf_redirect_url ="http://www.baidu.com"
config_output_html=[[                                     #下面是html的内容
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<meta http-equiv="Content-Language" content="zh-cn"/>
<title>网站防火墙</title>
</head>
<body>
<h1 align="center"># 您的行为已违反本网站相关规定，注意操作规范。详情请联微信公众号：chuck-blog。
</body>
</html>
]]

cd  /usr/local/openresty/nginx/conf/waf
cat access.lua
require‘init‘
function waf_main()
if white_ip_check()then
elseif black_ip_check()then
elseif user_agent_attack_check()then
elseif cc_attack_check()then
elseif cookie_attack_check()then
elseif white_url_check()then
elseif url_attack_check()then
elseif url_args_attack_check()then
--elseif post_attack_check()then
else
return
end
end
waf_main()

ab -c 100-n 100 192.168.4.10/index.php

This is ApacheBench,Version2.3<$Revision:1430300 $>
Copyright1996AdamTwiss,ZeusTechnologyLtd, http://www.zeustech.net/
Licensed to TheApacheSoftwareFoundation, http://www.apache.org/
Benchmarking www.chuck-blog.com (be patient).....done
ServerSoftware: openresty
ServerHostname: 192.168.4.10
ServerPort:80
DocumentPath:/index.php
DocumentLength:0 bytes
ConcurrencyLevel:100
Time taken for tests:0.754 seconds
Complete requests:10
Failed requests:90                             #config.lua中设置的，60秒内只允许10个请求
Write errors:0
Non-2xx responses:90
Total transferred:22700 bytes
HTML transferred:0 bytes
Requests per second:132.65[#/sec](mean)
Time per request:753.874[ms](mean)
Time per request:7.539[ms](mean, across all concurrent requests)
Transfer rate:29.41[Kbytes/sec] received
ConnectionTimes(ms)
min mean[+/-sd] median max
Connect:236920.264105
Processing:32180144.5157629
Waiting:22179144.5156629
Total:56249152.4220702
Percentage of the requests served within a certain time (ms)
50%220
66%270
75%275
80%329
90%334
95%694
98%701
99%702
100%702(longest request)
```
###3.5.3 模拟ip黑名单
将请求ip放入ip黑名单中

显示结果如下
![](ca1fa711-48e6-4041-a367-b15db7bf2d2f_128_files/c71edccb-507c-4340-a1fc-ad03e300a2fa.png)
###3.5.4 模拟ip白名单
将请求ip放入ip白名单中，此时将不对此ip进行任何防护措施，所以sql注入时应该返回404

显示结果如下
![](ca1fa711-48e6-4041-a367-b15db7bf2d2f_128_files/3ded0e02-480f-48f4-8aab-41aff0fc5538.png)
###3.5.5 模拟URL参数检测
浏览器输入www.chuck-blog.com/?a=select*from table
显示结果如下
![](ca1fa711-48e6-4041-a367-b15db7bf2d2f_128_files/744e4a20-5558-43fc-9f50-1546cbc765a3.png)
详细规定在arg.rule中有规定,对请求进行了规范
```bash
[root@iZ28t900vpcZ rule-config]# /usr/local/openresty/nginx/conf/waf/rule-config/cat args.rule
\.\./
\:\$
\$\{
select.+(from|limit)
(?:(union(.*?)select))
having|rongjitest
sleep\((\s*)(\d*)(\s*)\)
benchmark\((.*)\,(.*)\)
base64_decode\(
(?:from\W+information_schema\W)
(?:(?:current_)user|database|schema|connection_id)\s*\(
(?:etc\/\W*passwd)
into(\s+)+(?:dump|out)file\s*
group\s+by.+\(
xwork.MethodAccessor
(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\(
xwork\.MethodAccessor
(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\:\/
java\.lang
\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\[
\<(iframe|script|body|img|layer|div|meta|style|base|object|input)
(onmouseover|onerror|onload)\=
[root@iZ28t900vpcZ rule-config]# pwd
/usr/local/openresty/nginx/conf/waf/rule-config