Using the vCanopy 6G Web Application Firewall

But… I want to log all requests that pass my whitelist

This isn’t advised for a few reasons, logging takes resources and all the passing requests will still be logged in the Nginx access log so there is no real need to duplicate the logging, however more importantly in the whitelist rules above you can see we are resetting the built-in Nginx writable variable $args with the $original_args.

This is because Nginx logging only allows you to use preset variables, and the vast majority of these are not writable. The $args variable however is writable. During the filtering of requests through the rules, any that breach a rule have their reasons written to $6g_reason which then overwrites the $args variable. However, before we do this we store the original $args value in a temporary $original_args variable because any request that is whitelisted will need the original value restored before the request can be processed.

We can temporarily log requests bypassing the rules via our whitelists for testing purposes by setting the following variable values in our whitelist:

$args "${6g_reason}:Bypassed";
set $drop_log 0;

For example:

if ($bad_method = $exclusion_rule_match) { 
    set $6g_drop_bad_method 0; 
    set $args "${6g_reason}:Bypassed";
    set $drop_log 1;
}

Now any request that passed due to the whitelisting will log out like so:

[21/Jan/2020:06:18:35 +0000] [":bad_methods_6::Bypassed"] 199.199.199.199 vCanopy.com "PUT /wp-content/plugins/awesome-plugin/plugin.php HTTP/2.0" 405 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:73.0) Gecko/20100101 Firefox/73.0"

But remember, while this temporary logging is active the request will not be processed normally, it has been stripped of all query parameters and arguments.

To enable normal processing remember to reset the following variables:

set $args "${original_args}";
set $drop_log 0;

But… I am behind a proxy and can’t access my Real IP?

That shouldn’t be any problem vCanopy comes autoconfigured with Real IP set up for all Cloudflare, StackPath, and Sucuri proxies. It can also be easily configured for any other proxy using the following include:

/etc/nginx/extra.d/realip-context.conf

If you are using a proxy then we would replace the $remote_addr Nginx variable with the $realip_remote_addr nginx variable instead.

Like so:

if ($realip_remote = "54.191.137.17") { 
    ...
}