I need some help figuring out how to implement a Web Application Firewall (WAF) in my existing architecture.
Currently I have 2 HAproxy servers clustered using keepalived which are responsible for the following:
- Load Balancing
- SSL Termination
- Re-directing static traffic to cache servers
I have 1 varnish server that is only caching static content. My Traffic flow looks something like this:
Load Balancer (haproxy)-+---------(Dynamic content)-------+----- Drupal Servers \ / +-- (Static Content) Varnish --+
And my HaProxy config looks like this:
In this scenario, where is a good place to put a WAF? It would be preferable to not introduce any more servers so ideally a WAF that would run on the HAProxy servers. I know Varnish has some WAF capabilities but it currently only serves static assets. Should I re-architect this solution to route all traffic though varnish?