training-software/docs/modsecurity-pl4-nginx.md

ModSecurity for Nginx Reverse Proxy (CRS Paranoia Level 4)

This repository now includes a prepared ModSecurity ruleset under:

• nginx/modsecurity/main.conf
• nginx/modsecurity/crs-setup/custom-pl4.conf
• nginx/modsecurity/custom-rules.conf

1) Prerequisites

Your reverse proxy Nginx must have the ModSecurity v3 connector enabled (modsecurity-nginx). A stock nginx:alpine image does not include this module.

2) Mount the rules into your reverse proxy

Mount the directory into the proxy container, for example:

volumes:
  - ./nginx/modsecurity:/etc/nginx/modsecurity:ro

Your proxy image should also provide:

• /etc/nginx/modsecurity/modsecurity.conf
• /etc/nginx/modsecurity/owasp-crs/rules/*.conf

3) Enable ModSecurity in the virtual host

Inside the server block (or per location):

modsecurity on;
modsecurity_rules_file /etc/nginx/modsecurity/main.conf;

4) Reload and verify

nginx -t
nginx -s reload

Then send test payloads and confirm ModSecurity audit/error logs show rule matches.

Notes

• PL4 is intentionally strict and can produce false positives.
• If production traffic is noisy, start with SecRuleEngine DetectionOnly, tune exclusions, then switch to On.