Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You can put a self-hosted web application firewall (WAF) in front of a web app quickly if Docker and the app are already running on a network the WAF can reach. A practical route is the OWASP Coraza and Core Rule Set (CRS) Docker reverse proxy. The documented commands are a quick start, not evidence that every setup takes two minutes or is ready for production.
What you are setting up
A WAF inspects HTTP requests before they reach your application. In this setup, Coraza is the WAF engine, OWASP CRS supplies generic detection rules, and a proxy container forwards requests to your app after inspection. OWASP describes Coraza as supporting ModSecurity’s SecLang rule language and compatibility with CRS; Coraza can be used through connectors, including Caddy and Docker (Coraza).
CRS is not an engine by itself. OWASP describes it as a set of generic attack-detection rules for ModSecurity or compatible WAFs, covering common attack categories such as SQL injection, cross-site scripting, and local file inclusion (OWASP CRS). The quick-start container repository combines the components as reverse-proxy variants that inspect traffic before forwarding it to a backend (Coraza CRS Docker repository).
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick start with the Coraza CRS Docker proxy
This path assumes Docker is installed, your web app is already running, and the WAF container can reach it over a Docker network. The repository documents Compose profiles for Caddy, Nginx, and Apache, as well as direct Docker examples. Choose one proxy, configure the backend to match your app’s reachable service name and port, and use the port assigned to that variant.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
- Check connectivity first. Identify the app’s backend hostname or container/service name and listening port from the WAF container’s network. Do not use
localhostunless the app is in the same container; inside a separate container, it refers to that container itself. - Start one documented proxy variant. In the repository’s Compose quick start, the Caddy profile publishes host port
8080, Nginx uses8081, and Apache uses8082. Run the profile and Compose command shown in the repository for the selected variant; set its backend value to the app’s actual address and port. These ports are example configuration values, not universal defaults for other deployments. - Route a normal request through the proxy. Open or request the host and port published by the WAF container, not the backend directly. Confirm the application responds as expected through that route before changing public traffic routing.
- Run the repository’s sample checks. Its example normal request should return HTTP
200; the sample SQL-injection query should return403in that demonstration configuration. These results show that the example route and rule behavior work; they do not establish comprehensive protection for your app.
Use the repository’s current instructions for exact commands and environment-variable names, since container tags and project configuration can change. Stable image tags include a CRS version and timestamp; the repository warns against using rolling tags in production. Select and pin a reviewed stable or LTS tag rather than silently following a moving build, and verify available tags before deployment (Coraza CRS Docker repository).
Before sending production traffic through it
A working proxy test is only the first step. The repository’s quick start does not provide a complete production deployment checklist. Confirm the operational details that affect availability, correct request handling, and security before switching live traffic.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
- TLS termination: Decide whether HTTPS ends at this proxy or at an upstream load balancer. Ensure the connection between components meets your security requirements.
- Forwarded headers: Verify how the app receives the original client address, host, and protocol, and trust forwarded values only from known proxies.
- Health checks and rollback: Confirm that the proxy and backend are monitored, and retain a route back to the previous traffic path if the proxy causes errors.
- Logs and tuning: Review WAF events and identify legitimate requests that trigger rules. Add narrowly scoped exclusions only after understanding the event and its effect.
- Request limits: Check body-size and upload behavior against the app’s real needs so legitimate requests are not rejected unexpectedly.
- Rule and image updates: Set an update and review process for both the WAF image and rules. Test changes before applying them to production.
Roll out blocking carefully
Rules can block legitimate traffic when they conflict with an application’s inputs or behavior. For ModSecurity deployments, the installation guide recommends beginning with SecRuleEngine DetectionOnly, reviewing and tuning events, and enabling blocking after that process. It also cautions that high debug levels can significantly affect performance (ModSecurity installation guide). That is a useful cautious rollout pattern; the exact configuration depends on the WAF engine and integration you choose.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When Coraza/CRS or ModSecurity fits
Coraza with the CRS Docker proxy is a short route when your app already runs in a Docker environment and a separate reverse proxy is appropriate. ModSecurity is another open-source WAF engine, with documented Apache and Nginx installation paths. CRS can be used with ModSecurity or another compatible engine. The available project documentation does not establish a universal winner or comparable throughput figures, so choose based on your existing stack and operational needs (Coraza; Coraza CRS Docker repository; ModSecurity installation guide; OWASP CRS).
Quick Recap
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
- Integration: Check whether you want a separate containerized proxy or WAF functionality integrated with an existing web server.
- Operational work: Plan for upgrades, rule updates, log review, false-positive tuning, and recovery—not just initial installation.
- Rollout controls: Prefer an approach that lets you observe and tune before blocking production requests.
- Deployment scope: This article covers an inline, self-managed proxy. A hosted edge service is a different deployment model and is not required for this Docker setup.
- Reproducibility: Pin a reviewed stable or LTS image version; avoid relying on rolling tags for production.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
