ModSecurity & OWASP Core Rule Set on OPNsense
ModSecurity with the OWASP Core Rule Set turns OPNsense into a full-fledged Web Application Firewall – free, open source, and precisely tunable to your applications. The decisive success factor is not the installation, but the clean tuning work afterwards, so that attacks are blocked and legitimate traffic gets through.
What is ModSecurity?
ModSecurity is an open-source web application firewall engine. On OPNsense, we operate it behind HAProxy or Caddy as a reverse proxy: All incoming web traffic to your application first passes through ModSecurity, is checked against a set of rules, and is only forwarded to the actual server if the result is inconspicuous.
As a rule set, we use the OWASP Core Rule Set (CRS) – the industry reference for generic attack detection, maintained by an independent security community rather than a single manufacturer.
How we set up ModSecurity for your application
The installation of ModSecurity + CRS is done in a few minutes. The actual effort – and our actual work – lies in the tuning: two independent adjustment screws decide whether the WAF reliably blocks attacks without paralyzing your own application.
How strictly is it checked?
Four levels (PL1–PL4) determine how many rules are active. PL1 covers the obvious attack patterns, PL4 checks extremely precisely – but generates significantly more false alarms. For most business applications, we configure PL1–PL2 as a starting point.
When is it blocked?
Every suspicious anomaly adds points to an anomaly score; only when a threshold (default: 5) is exceeded does the WAF block the request. We adapt this threshold and specific exception rules to your real application instead of working with factory settings.
OPNsense + ModSecurity or Sophos SFOS WAF?
Community rule set, full control
Integrated directly into the firewall
Weeks of fine-tuning instead of factory settings – and a passed pentest
For a medium-sized banking house, we gradually hardened a WAF (at that time an older Sophos UTM firewall) over several weeks instead of working with factory settings: The reverse proxy was restricted to the networks allowed within the bank, form hardening was activated, and SQL injection and other filters were fine-tuned to what was actually necessary – instead of being set to the highest level across the board. Result: The external penetration test was passed without critical findings. We still apply this exact philosophy today – preferring iterative and application-specific tuning over a one-time maximum setting – whether with Sophos SFOS or OPNsense + ModSecurity.