RhinoWAF

self-hosted layer 7 web application firewall, written in go. AGPL-3.0.

github | readme | rules | changelog | releases

what it is

You run it on your own VPS in front of nginx, Caddy or Traefik. It sits between the internet and your app and deals with the layer 7 noise: floods, bots, and injection attempts. Website, panel, store, API on 80/443. Not a game server proxy.

what it does

• a detection engine with anomaly scoring. its own rule format, not ModSecurity. a real SQL tokenizer and an HTML-aware XSS check instead of a list of banned words, so grant writing tips goes through and ' or 1=1-- does not
• every block says why: rule id, which argument, the bytes that matched. there is a detect mode so you can watch a new site for a day before you turn blocking on
• rate limiting, slowloris protection, per-IP rules, geo and ASN rules, hot reloaded from json
• challenges: javascript, proof of work, hCaptcha, Turnstile. browser fingerprinting to catch bot nets sharing one browser
• bans and solved challenges survive a restart (bbolt file next to the logs, signed cookies)
• exemptions for your own monitoring, body size limits, honeypot paths that ban on contact
• HTTP request smuggling checks, websocket limits, multi-vhost reverse proxy
• one static binary, default rules built in. runs with no config at all

run it

git clone https://github.com/1rhino2/RhinoWAF.git
cd RhinoWAF
go build -o rhinowaf ./cmd/rhinowaf
./rhinowaf -listen :8080 -backend http://127.0.0.1:3000

or grab a binary from releases. config is json under config/, see the readme. ./rhinowaf -check-rules validates config and rules like nginx -t.

what a block looks like

[ENGINE] BLOCK 203.0.113.9 POST /login score=7/5 pl=1 top=args:user rules=942100,942190 req=ab12

status

2.0.x. solid enough to self host, test it in staging against your real host headers and webhooks first. no warranty.

issues | license