What's new: rule testing sandbox
Test exactly how the WAF treats a request before you change anything in production. Send a crafted or real request through a site's actual rules (paranoia level, threshold, exclusions and custom rules) and see which rules match and whether it would be blocked.
- Rules → Sandbox. Paste or edit a raw HTTP request (request line, headers, a blank line, then the body), pick the site and click Run test. The result shows the verdict, the anomaly score against the threshold, and every matched rule with the parameter it matched.
- Replay a real request. In Logs, open a blocked or detected request and click Test in sandbox to replay it exactly, body included.
- Try a rule before saving it. Tick Compare with a draft custom rule to see the verdict with and without the rule you're writing. To test a change to an existing custom rule, use that rule's ID. If the engine rejects the rule, you get its error message.
- Check an exclusion exactly. In the Tune… dialog, Replay this request with the exclusion shows the original request's verdict before and after, next to the impact estimate.
- Isolated from production. Tests run in a separate sandbox container. Nothing is sent to your sites, the production WAF is never reloaded, and test requests never appear in WAF Logs, alerts or log forwarding.
The User Guide has a new Rule Testing Sandbox section.
⚠️ Update your docker-compose.yml
The sandbox runs in a new waf-sandbox service. It uses the existing waf-caddy image, has no published ports, and is limited to 256 MB of memory and half a CPU. Get the updated docker-compose.yml from this repository (git pull, or copy the new waf-sandbox block) before upgrading.
Without that service, everything else works as before and Rules → Sandbox reports that it's unavailable.
Things to know
- Available to the admin and operator roles. Limited to 30 tests per minute per user.
- The sandbox always runs in blocking mode so you see a verdict. For a site in detection mode, a "Blocked" result means production would log the request rather than block it.
- Only the WAF rules run. GeoIP blocking, IP ACLs, rate limiting, allowed methods and authentication are not applied. Rules that look at the client IP see the admin API's address.
Upgrade
git pull # get the new docker-compose.yml
docker compose pull
docker compose up -d
latest points to this release. If you pin versions, set WAF_IMAGE_TAG=1.0.25 (no v prefix) before pulling.
Images: ghcr.io/socfortress/waf-caddy:1.0.25 (also used by waf-sandbox), ghcr.io/socfortress/waf-admin-api:1.0.25, ghcr.io/socfortress/waf-admin-ui:1.0.25