Nginx + ModSecurity + OWASP CRS + Lua + GEOIP2 构建传统WAF

一、环境介绍

操作系统：龙蜥 OS 8.9
服务器：nginx：10.99.99.99
nginx: 1.25.5
https://github.com/nginx/nginx/releases/tag/release-1.25.5
LuaJIT：v2.1-20250529
https://github.com/openresty/luajit2
ngx_devel_kit: 0.3.4
https://github.com/vision5/ngx_devel_kit
lua-nginx-module: 0.10.28
https://github.com/openresty/lua-nginx-module
lua-resty-core：v0.1.31
https://github.com/openresty/lua-resty-core
lua-resty-lrucache：v0.15
https://github.com/openresty/lua-resty-lrucache
ModSecurity v3（libmodsecurity）：3.0.14
https://github.com/owasp-modsecurity/ModSecurity
ModSecurity-Nginx 连接器：1.0.4
https://github.com/owasp-modsecurity/ModSecurity-nginx/
OWASP Core Rule Set (CRS)：4.15.0
https://github.com/coreruleset/coreruleset
geoip2：3.4
https://github.com/leev/ngx_http_geoip2_module
libmaxminddb：1.12.2
https://github.com/maxmind/libmaxminddb
GeoLite2 数据库
官方（需要注册）：https://dev.maxmind.com/geoip/geolite2-free-geolocation-data/
github分享：https://github.com/P3TERX/GeoLite.mmdb?tab=readme-ov-file

二、编译工具安装

dnf install epel-release -y
dnf install gcc gcc-c++ pcre pcre-devel zlib zlib-devel openssl openssl-devel make GeoIP-devel flex bison yajl yajl-devel curl-devel curl doxygen
dnf install -y autoconf automake libtool m4 git

可能会用到代理

git config --global http.proxy socks5h://x:10808
git config --global https.proxy socks5h://x:10808

三、编译安装ModSecurity v3

git clone --recursive https://github.com/owasp-modsecurity/ModSecurity ModSecurity
cd ModSecurity
git submodule update --init --recursive
./build.sh
./configure
make -j$(nproc)
make install

添加环境变量

tee /etc/profile.d/modsecurity.sh >/dev/null <<EOF
export PKG_CONFIG_PATH=/usr/local/modsecurity/lib/pkgconfig:$PKG_CONFIG_PATH
EOF

加载环境变量

source /etc/profile.d/modsecurity.sh

验证

pkg-config --modversion modsecurity

四、ModSecurity-Nginx 连接器下载

git clone https://github.com/owasp-modsecurity/ModSecurity-nginx.git

五、编译安装LuaJIT

git clone https://github.com/openresty/luajit2.git
cd luajit2/
make -j$(nproc)
make install PREFIX=/usr/local/luajit

添加环境变量

tee /etc/profile.d/luajit.sh >/dev/null <<EOF
export LUAJIT_LIB=/usr/local/luajit/lib
export LUAJIT_INC=/usr/local/luajit/include/luajit-2.1
export LD_LIBRARY_PATH=/usr/local/luajit/lib:\$LD_LIBRARY_PATH
EOF

加载环境变量

source /etc/profile.d/luajit.sh

创建软连接

ln -sf /usr/local/luajit/bin/luajit /usr/local/bin/luajit

六、ngx_devel_kit下载

git clone https://github.com/vision5/ngx_devel_kit.git

七、lua-nginx-module下载

git clone https://github.com/openresty/lua-nginx-module.git

八、编译安装lua-resty-core

git clone https://github.com/openresty/lua-resty-core.git
cd lua-resty-core
make install

九、编译安装lua-resty-lrucache

git clone https://github.com/openresty/lua-resty-lrucache.git
cd lua-resty-lrucache
make install

十、OWASP Core Rule Set (CRS)下载

git clone https://github.com/coreruleset/coreruleset.git

十一、下载geoip2模块和数据库

git clone https://github.com/leev/ngx_http_geoip2_module.git

登陆后下载
https://www.maxmind.com/en/home

数据文件是这个三个

十二、编译libmaxminddb

读取 geoip2 数据库用

./configure
make
make check
make