Okay, if you have web applications exposed to the internet, be it a blog, an API, your own Coolify, or whatever, I’m going to ask you a very direct question: how are you protecting them?
Because look, as soon as you publish something on the internet, bots and attacks start arriving. And I’m not exaggerating, literally in minutes. SQL injections, brute force attacks, XSS… the list is long and a bit scary.
And here comes the problem: professional web application firewalls, the famous WAFs, are usually incredibly expensive. We are talking about hundreds or thousands of euros a year. For a large company, okay, they can afford it. But for you, who have a server at home or a modest VPS… well, it doesn’t quite fit.
Well, today I bring you SafeLine, a completely free, self-hosted WAF, which you can install on your own server and which gives you enterprise-level protection. And no, I haven’t gone crazy, it really exists.
What the hell is a WAF and why do you need it?
Well, to explain it easily: imagine that your web server is your house, and the WAF is a huge nightclub bouncer placed at the door. All traffic that wants to enter your website has to pass first through this bouncer, who analyzes each request and decides: “you pass because you are legitimate” or “you get out, you come with bad intentions”.
SafeLine does exactly that. It sits in front of your web applications like a reverse proxy, and filters all malicious traffic before it reaches your server. It blocks SQL injections, XSS, attempts to access protected paths, brute force attacks, malicious bots… basically everything you don’t want touching your application.
And here comes the strong part: the free version of SafeLine is forever. It is not a 14-day trial or a capped version that is useless. You can protect up to 10 applications without paying a euro. For a homelab or personal projects, it is more than enough.
What I am going to teach you today is how to install SafeLine from scratch, configure it to protect your first application, and we will see live how it blocks real attacks. Because one thing is for me to tell you that it works, and another is to see it with your own eyes.
What do you need to set up SafeLine?
Okay, before we get down to work, what do you need to set up SafeLine?
The good news is that the requirements are quite modest. You need a Linux server, be it a VPS, a Raspberry Pi 3 or higher, or that old PC you have gathering dust. Mind you, you need x86_64 or ARM64 architecture.
You also need to have Docker version 20.10 or higher, and Docker Compose version 2.0 or higher installed.
And here comes what I think is great: the minimum hardware is only 1 CPU core, 1GB of RAM and 5GB of disk. That is, anything you have at home is worth it.
There is a technical detail: the CPU has to support SSSE3 instructions, but don’t worry, any moderately modern processor has them. If you have a computer from the last 10-15 years, you are more than fine.
If you don’t have a server, I remind you that I have a post where I teach you how to get one for free with Oracle Cloud, with 4 cores and 24GB of RAM. Of course, for SafeLine I recommend that you use one with x86_64 architecture to avoid messes.
Step-by-step installation (less than 10 minutes)
Well, let’s get into the mud. I’m going to install SafeLine from scratch so you can see how easy it is.
Step 1: Connect to your server
First, open your terminal and connect to your server via SSH:
ssh user@your_server_ipStep 2: Run the automatic installer
SafeLine has an installation script that does all the dirty work for you. You just have to run this command:
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --enThis command downloads the script and executes it. The first thing it will ask you is what you want to do: choose option 1 for standard installation.
Then it asks you where you want to install it. The default is /data/safeline, and it’s fine, so hit Enter.
And now… we wait. The script will install Docker if you don’t have it, download all the necessary images, and configure everything automatically. Depending on your connection, it may take a few minutes.
Step 3: Get access credentials
When the installation finishes, at the end of the process it will show you something VERY important: the administration panel URL and the initial credentials. Something like:
- URL:
https://your-ip:9443 - User:
admin - Password: a randomly generated one
Write down that password because you will need it. If you miss it or lose it, you can regenerate it by running:
docker exec safeline-mgt resetadminStep 4: Access the panel
Now go to your browser and type your server IP followed by port 9443. For example: https://192.168.1.100:9443
You will get an SSL certificate warning because it is self-signed, you accept it and that’s it. You enter the user admin and the password it gave you, and… welcome to SafeLine.
The first thing you will see is the dashboard, which for now is empty because we haven’t configured anything. But we are going to fix that right now.
Configure your first protected application
Okay, we already have SafeLine running, but now it’s time for the important part: protecting a web application.
We go to the Applications tab and click on Add Application.
Here you have to fill in three key things:
Domain: The domain or IP of your application. For example, myapp.mydomain.com.
Port: The port where SafeLine will listen. If it is normal HTTP, port 80. If it is HTTPS, port 443. For HTTPS, you have to check the SSL box and add a certificate. SafeLine allows you to generate it automatically with Let’s Encrypt, so it’s super easy.
Upstream: This is critical. It is the REAL address of your application, where SafeLine will redirect clean traffic. If your app runs on the same server on port 3000, you would put http://127.0.0.1:3000.
You hit save, and that’s it. Now all traffic reaching that domain passes first through SafeLine.
By default, SafeLine already comes configured to defend against all the most common types of attacks: SQL injection, XSS, path traversal, code execution… You don’t have to touch anything else, it is already protected.
Seeing SafeLine in action: blocking real attacks
Well, now comes the fun part. Let’s prove that this really works.
I’m going to launch some typical attacks on my protected application and see what happens.
First, a classic SQL Injection attempt:
https://myapp.com/rest/products/search?q=%27%20OR%20%271%27=%271And… blocked. SafeLine shows us a block page indicating that it has detected an attack.
We try with XSS (Cross-Site Scripting):
https://myapp.com/#/search?q=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E#/Blocked too.
If we go to the panel, in the Attacks tab, we see all the attack attempts that SafeLine has intercepted: the attacker’s IP, the type of attack, the timestamp… everything recorded.
But watch out, here comes a brutal functionality: the anti-bot protection. We go to the configuration of our application, activate Bot Protect, and now any bot that tries to access will have to pass a captcha. Human users solve it without problem, but bots are left out.
This feature in other WAFs they charge you for, here you have it for free.
Other features that will blow your mind
And this is just the tip of the iceberg. SafeLine has many more things that will surprise you.
Rate Limiting: You can limit requests per IP to avoid DDoS or brute force attacks. You configure a maximum of requests per minute and that’s it, the attackers are left hanging.
Allow/Deny Lists: Block specific IPs or entire countries if you need to. If you see that you are being attacked from a specific region, you block it and that’s it.
Authentication: You can add an extra login layer to any application without touching its code. This is brutal if you have internal services that you want to protect with double authentication.
HTTP Flood Protection: If they try to knock you down based on requests, SafeLine sends them to a waiting room. It’s like when you go to buy tickets online and it says “wait your turn”, but security version.
For more serious projects there are paid plans: $10 a month for Light, $100 for Pro. But honestly, the free version for homelab and personal projects is more than enough.
Why you should install SafeLine now
Well, and this has been SafeLine. A free, self-hosted WAF, that you can have running in less than 10 minutes and that really protects you.
If you have web applications exposed to the internet and you are not protecting them with a WAF, I sincerely recommend it. I have it mounted on my server and since then I sleep much more peacefully.
The attacks are going to arrive yes or yes. It is not a question of if they are going to attack you, but when. And when that moment comes, better to have a bouncer at the door who leaves out all the garbage.
Also, it’s free. You have no excuse. Seriously, it takes longer to make a coffee than to install SafeLine.
And if you still don’t have your own server, you already know that I have the free Oracle Cloud server tutorial, which is the perfect complement to this.
Useful links
If you want to delve deeper or need the official documentation, here I leave you some links that will serve you:
SafeLine official website: https://ly.safepoint.cloud/HE5s0ug
SafeLine Discord (in case you have doubts or want to see what the community does): https://discord.gg/dy3JT7dkmY
SafeLine live demo (so you can try it without installing anything): https://demo.waf.chaitin.com:9443/statistics
Official installation documentation: https://docs.waf.chaitin.com/en/GetStarted/Deploy
For my part this has been all and see you in the next post.
O que você achou?
Deixe sua opinião, pergunta ou sugestão. Os comentários são sincronizados com GitHub Discussions .