DEV Community

Sharon
Sharon

Posted on

Why SafeLine Might Be the Best Open Source WAF You Haven’t Tried Yet

#websecurity #waf #opensource #devops

Image description

SafeLine is a free and open source Web Application Firewall (WAF) developed by Chaitin Tech. It’s lightweight, powerful, and offers enterprise-grade protection against a wide range of attacks — SQLi, XSS, RCE, SSRF, Path Traversal, and more.

🚀 Quick Deployment with Docker 

mkdir -p "/data/safeline"
cd "/data/safeline"
wget "https://waf-ce.chaitin.cn/release/latest/compose.yaml"

# Edit environment variables
vi .env
Enter fullscreen mode Exit fullscreen mode

.env sample:

SAFELINE_DIR=/data/safeline
IMAGE_TAG=latest
MGT_PORT=9443
POSTGRES_PASSWORD=yourpassword
SUBNET_PREFIX=172.22.222
IMAGE_PREFIX=swr.cn-east-3.myhuaweicloud.com/chaitin-safeline
ARCH_SUFFIX=
RELEASE=
REGION=
Enter fullscreen mode Exit fullscreen mode

Start SafeLine:

docker compose up -d
Enter fullscreen mode Exit fullscreen mode

🔒 How It Works

Without SafeLine:

User → Web Server
Enter fullscreen mode Exit fullscreen mode

Image description
With SafeLine:

User → SafeLine (reverse proxy) → Web Server
Enter fullscreen mode Exit fullscreen mode

Image description

Just like Nginx, it sits in front of your app and inspects every request.

Image description

🧑‍💻 Admin Console 

# Reset admin password
docker exec safeline-mgt resetadmin
Enter fullscreen mode Exit fullscreen mode

Access the console at:

https://<your-ip>:9443

Image description

🌐 Add Sites & Free HTTPS Certificates

  • Go to Applications → Add Application
  • Forward port 80 and 443 to your backend service
  • Works like a transparent reverse proxy
  • Supports Let's Encrypt with auto-renew — just enter the domain!

Bonus: Enable Auto HTTP to HTTPS redirect under Global Config.

🛡️ Protection Modes

Image description

Choose your site's defense level:

  • Defense: Block all attacks
  • Audited: Only log suspicious behavior
  • Offline: Show a maintenance page

A session ID sl-session is injected for tracking.

🌍 Join the Community

Stay tuned for Part 2, where we test SafeLine with real attack payloads and benchmark it against Cloudflare, ModSecurity, and others.

Top comments (0)