宝塔面板搭配雷池WAF防火墙实战

背景

因近期总是受到CC攻击，所以就找到了这款免费WAF

雷池是长亭科技耗时近 10 年倾情打造的 WAF，核心检测能力由智能语义分析算法驱动。

Slogan: 不让黑客越雷池半步。这里是官方地址：长亭雷池 WAF 社区版 (chaitin.cn)

部署资源

建议使用两台服务器，一台用来搭建雷池WAF，一台用来搭建Web

我这边使用一台来演示

系统版本：Centos7.6

规格：CPU - 2核 内存 - 2GB 系统盘 - SSD云硬盘 40GB

部署开始

安装宝塔

自行部署

安装网站建设必要软件

我这里是静态站所以安装nginx,mysql,phpdocker是后边waf安装需要动用到的所以也是必须安装。根据自己的网站环境需要安装即可。

修改默认端口

这里需要修改 nginx 默认监听端口 80（http）443（https）

找到/www/server/panel/vhost/nginx/0.default.conf文件修改如下：

server
{
    listen 90; 
    server_name _;
    index index.html;
    root /www/server/nginx/html;
}

找到/www/server/panel/vhost/nginx/phpfpm_status.conf文件修改如下：

server {
    listen 90;
    server_name 127.0.0.1;
    allow 127.0.0.1;
    location /nginx_status {
        stub_status on;
        access_log off;
    }
    location /phpfpm_52_status {
        fastcgi_pass unix:/tmp/php-cgi-52.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_53_status {
        fastcgi_pass unix:/tmp/php-cgi-53.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_54_status {
        fastcgi_pass unix:/tmp/php-cgi-54.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_55_status {
        fastcgi_pass unix:/tmp/php-cgi-55.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_56_status {
        fastcgi_pass unix:/tmp/php-cgi-56.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_70_status {
        fastcgi_pass unix:/tmp/php-cgi-70.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_71_status {
        fastcgi_pass unix:/tmp/php-cgi-71.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_72_status {
        fastcgi_pass unix:/tmp/php-cgi-72.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_73_status {
        fastcgi_pass unix:/tmp/php-cgi-73.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_74_status {
        fastcgi_pass unix:/tmp/php-cgi-74.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_75_status {
        fastcgi_pass unix:/tmp/php-cgi-75.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_80_status {
        fastcgi_pass unix:/tmp/php-cgi-80.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_81_status {
        fastcgi_pass unix:/tmp/php-cgi-81.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
    location /phpfpm_82_status {
        fastcgi_pass unix:/tmp/php-cgi-82.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    }
}

更改完成后需要到nginx面板去重载配置以及重启操作！以防万一这两项操作必须都进行！

新建网站

新建网站时，域名后边加除80的其他端口。这里我修改成90

网站开启ssl后需要修改端口除443的其他端口。这里我修改成8443：

安装长亭waf

官网提供了三种安装方式，这里我选择在线安装，使用命令：

执行以下命令，即可开始安装

bash -c "$( curl -fsSLk https://waf-ce.chaitin.cn/release/latest/setup.sh )"