Apache WAF

April 4, 2026 · View on GitHub

Apache WAF

An Apache httpd module providing IP/CIDR-based access control with named lists and tag-based organization. Port of nginx-waf for Apache.

Implementation: Rust core with thin C FFI shim for Apache module registration.

Features

Radix tree IP/CIDR lookup — O(32) for IPv4, O(128) for IPv6
Named lists — organize IP lists by name and purpose
Tag-based organization — enable/disable groups of lists by tag
Blacklist/whitelist modes — flexible access control strategies
Per-context configuration — different policies at server, directory, location level
Atomic file parsing — safe list file loading
Memory safe — Rust core prevents buffer overflows and use-after-free

Quick Start

1. Install

Debian/Ubuntu:

apt install apache-waf

2. Configure Apache

LoadModule waf_module modules/mod_waf.so

WafList tor "/etc/apache2/waf/tor-exits.txt" "anonymizers,privacy"
WafList botnets "/etc/apache2/waf/botnets.txt" "security"

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/html

    Waf on
    WafMode blacklist
    WafEnableLists tag:security

    <Location /admin>
        Waf on
        WafMode whitelist
        WafEnableLists admin-only
    </Location>
</VirtualHost>

Configuration Reference

Directive	Context	Default	Description
`Waf`	server config, virtual host, directory, location	`off`	Enable/disable WAF checking
`WafMode`	server config, virtual host, directory, location	`blacklist`	`blacklist` or `whitelist`
`WafList`	server config	—	Define a named IP list: `WafList name path "tags"`
`WafEnableLists`	virtual host, directory, location	—	Enable specific lists (by name or `tag:tagname`)
`WafDisableLists`	virtual host, directory, location	—	Disable specific lists
`WafLogPrefix`	server config	`[waf]`	Log message prefix

Ecosystem

The apache-waf module works with companion services for dynamic management:

Component	Description	GitHub
apache-waf	Core Apache module (this project)	GitHub
apache-waf-api	REST API for dynamic IP list management	GitHub
apache-waf-feeds	Automatic threat feed updater	GitHub
apache-waf-ui	Web management interface	GitHub

Browser/CLI → apache-waf-ui → apache-waf-api → IP List Files → apache-waf (module)
                                                     ↑
                                          apache-waf-feeds (auto-update)

Building from Source

cargo build --release
make
sudo make install

nginx Counterpart

nginx Module	Apache Module
nginx-waf	apache-waf (this project)

License

Apache License 2.0. See LICENSE.md.