We run BitNinja WAF Pro on one of our Enhance nodes, around 74 sites, mostly ecommerce. We've hit a run of issues over the past couple of weeks and I'd like to know whether others here are seeing the same, or whether we're an unlucky edge case.
Before the list, a genuine word about their support. The engineers have been responsive, they've escalated to their developers rather than fobbing us off, and when we've brought them evidence they've accepted it and confirmed bugs instead of arguing. That counts for a lot and I want to be fair to them. My concerns are with the product, not the people.
What we've run into:
New sites served the wrong SSL certificate. A newly added site presented the node's own certificate to visitors, so browsers threw a name mismatch warning. Confirmed as a bug and fixed quickly in 3.16.13.
Agent upgrades take the whole node offline briefly. The proxy stops but the firewall rules keep pointing at it, so for about 90 seconds nothing is listening on 80 and 443 and every site on the node is down. We now only upgrade in a quiet window.
Certificate issuance causes intermittent 502s. Every Let's Encrypt issuance made WAF Pro replace its internal nginx master, dropping requests in flight. Customers saw random 502s that never appeared in any Apache log, because the requests never reached Apache. Still open.
Real visitor IPs are currently lost. The interim fix for the 502s was to disable transparent proxy mode. That stopped the 502s, but now every visitor logs as the server's own address, so IP blocking, rate limiting and abuse investigation are all blind.
The X-Forwarded-For workaround only half covers it. It works where something upstream sets the header, in our case Cloudflare. WAF Pro does not set it itself, so traffic hitting the origin directly still logs the server IP. For us that is roughly 5% of requests and it is overwhelmingly bots, scanners and admin-path probes, which is precisely the traffic you want IPs for.
So, questions for anyone else on Enhance:
Are you running BitNinja on Enhance nodes, and do you see the certificate-related 502s? With Enhance issuing certificates regularly across a busy node this seems like it would be hard to avoid, so I'm curious whether others have simply not noticed them.
How are you getting real client IPs through to Apache? Is anyone running transparent proxy mode successfully without the 502 side effect?
What is everyone using for this layer generally? Worth noting that Enhance writes SecRuleEngine Off into every vhost it generates and ships no CRS ruleset, so out of the box there is no WAF at all and you need something third party.
Not looking to pile on a vendor that is at least engaging with us. I mainly want to know whether this is a general Enhance plus BitNinja integration problem or something specific to our setup.
