According to website of the open source firewall, ModSecurity; it can be deployed in 2 ways, Embedded and Proxy server (citation below)

Deployment Options

ModSecurity supports two deployment options: embedded and reverse proxy deployment. There is no one correct way to use them; choose an option based on what best suits your circumstances. There are advantages and disadvantages to both options:

  • Embedded

    ...The embedded option is a great choice for those who already have their architecture laid out and don't want to change it. Embedded deployment is also the only option if you need to protect hundreds of web servers. In such situations, it is impractical to build a separate proxybased security layer. Embedded ModSecurity not only does not introduce new points of failure, but it scales seamlessly as the underlying web infrastructure scales. The main challenge with embedded deployment is that server resources are shared between the web server and ModSecurity.

  • Reverse proxy

    Reverse proxies are effectively HTTP routers, designed to stand between web servers and their clients. When you install a dedicated Apache reverse proxy and add ModSecurity to it, you get a proper network web application firewall, which you can use to protect any number of web servers on the same network. Many security practitioners prefer having a separate security layer. With it you get complete isolation from the systems you are protecting. On the performance front, a standalone ModSecurity will have resources dedicated to it, which means that you will be able to do more (i.e., have more complex rules). The main disadvantage of this approach is the new point of failure, which will need to be addressed with a high-availability setup of two or more reverse proxies.

I understand how reverse proxy firewall works

  • X user at home
  • Y reverse proxy server acting as firewall that fetches website from Z
  • Z main web server which hosts the website

In reverse proxy, X <-- Y is visible to X but background X --> Y --> Z is hidden from X

Questions are:

  1. Can reverse proxy firewall secure more than one web servers, if yes then how?

    (because I set IP address of the web server Z in ModSecurity Y, and each Y can handle one IP address of Z, but the above citing says, reverse proxy deployment can protect any number of web servers)

  2. What is Embedded firewall, and how is it different from reverse proxy firewall?

  3. What is the difference between reverse proxy ModSecurity and Mod_Proxy?


It seems like the term firewall used in Web Application Firewall WAF is confusing you. In both deployment options, ModSecurity isn't an external firewall layer between a web server and the Internet, but works as a module inside Apache. Despite it does blocking and logging based on its own configuration, it doesn't intervene with the HTTP connection before Apache gets the data, but processes request inside Apache. That already explains embedded mode quite well.

In proxy mode, ModSecurity works exactly the same way, but on an Apache that is used as a reverse proxy instead of serving the content directly. ModSecurity doesn't provide the proxy itself, but uses Apache's mod_proxy. This way, you can protect all the web servers behind your reverse proxy, whether they are serving different sites (VirtualHosts spread on various servers, with different proxy settings) or a single site as a balancer.

  • 1
    Thanks a lot, was really a confusion between WAF and Firewall.. – GypsyCosmonaut May 15 '17 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.