How does FireFighter differ from a traditional firewall?

FireFighter works at Layer 7 (application layer), inspecting HTTP/S requests with the Coraza WAF engine and OWASP CRS rules. It analyzes client behavior, computes real-time IP reputation scores, and pushes bans down to kernel-level NFTables sets for zero-overhead packet drops.

Does FireFighter run as a Kubernetes Ingress Controller?

Yes. FireFighter features a dedicated Kubernetes Ingress Controller (firefighter-ingress) that translates standard Kubernetes Ingress objects and CRDs directly into high-speed WAF routing rules with auto-cert ACME provision.

What happens when a malicious request is detected?

The detector engine evaluates threat severity and IP reputation score. If the score breaches threshold, a gRPC event is published to ffsvc, which immediately updates kernel NFTables sets via firewalld, dropping subsequent connections before they reach application memory.

Next-Gen WAF

Kubernetes Ingress

Kernel-Level Blocking

FireFighter — L7 WAF & Next-Gen Ingress

Enterprise security appliance featuring the Coraza WAF engine, OWASP CRS protection, real-time IP reputation scoring, and high-speed NFTables kernel packet drops.

Deploy FireFighter Read Architecture Docs

3-Tier Distributed Architecture

Incoming HTTPS requests flow through the Layer 7 Coraza WAF proxy (`gateway`). Threat metrics stream to `detector` for IP reputation scoring, which commands `firewalld` to enforce kernel-level NFTables drops.

Enterprise Security Capabilities

Coraza WAF & OWASP CRS Engine

Integrated Coraza WAF engine supporting OWASP Core Rule Set (CRS) with paranoia levels 1-4, SQLi, XSS, RCE, and HTTP request smuggling protection.

Real-Time Threat Detection & Reputation

Continuous behavioral log parsing, bbolt reputation database, flow assembly, and automated threat intelligence feed ingestion (abuse.ch).

Kernel-Level NFTables Packet Dropping

Bans decided by the threat analyzer are synced into Linux kernel NFTables sets by the firewalld daemon, dropping malicious packets at wire speed.

Next-Gen Ingress & TLS Proxy

SNI-based TLS termination, ACME auto-certificates (Let's Encrypt), HTTP/1.1/2/3 support, wildcard vhosts, path radix-tree routing, and mTLS verification.

Rate Limiting & Security Headers

Token bucket rate limiting per vhost/IP, automatic HSTS/CSP/XFO header injection, and interactive captcha challenges for suspicious clients.

Real-Time Telemetry & SSE Web UI

Server-Sent Events (SSE) event bus, embedded NATS JetStream, and a modern React + PatternFly administration interface with live incident metrics.

FireFighter Suite Components

A modular set of Go binaries working together to deliver end-to-end web defense and ingress routing.

gateway (ffwaf)

apps/gateway/

TLS-terminating reverse proxy with SNI, Coraza WAF engine, rate limiting, mTLS, and ACME auto-certs.

ffsvc

apps/ffsvc/

Central management service exposing gRPC/REST APIs, SQLite persistence, embedded NATS, and SSE event streaming.

detector (ffdetect)

apps/detector/

Unified threat detector and analyzer with IP reputation scoring, threat intel feed sync, and malicious UA matching.

firewalld

apps/firewalld/

NFTables firewall daemon syncing ffsvc bans into Linux kernel sets for wire-speed packet filtering.

loglistener

apps/loglistener/

High-throughput web server log streaming daemon listening on Unix domain sockets.

firefighter-ingress

firefighter-ingress/

Native Kubernetes Ingress Controller mapping K8s Ingress and Custom Resources into FireFighter WAF instances.

FireFighter vs. Traditional Firewall & Cloud WAF

Combining the deep application context of a Layer 7 WAF with the wire-speed packet rejection of a Layer 3/4 kernel firewall.

Capability	FireFighter	Cloud WAF
Layer 7 Inspection (WAF)	Coraza Engine (OWASP CRS)
Kernel-Level Packet Drop (Layer 3/4)	NFTables Kernel Sync
Real-Time IP Reputation Scoring	Automated (bbolt Engine)	Paid add-on
Kubernetes Native Ingress Controller	firefighter-ingress CRD	Requires ingress bridge
On-Premises & Air-Gapped Deployment
HTTP/3 & QUIC Support
Zero Third-Party Data Exfiltration

Declarative Configuration & Management

Configure vhosts, WAF rules, and rate limits via TOML config files or manage live bans using the ffctl CLI.

toml

[general]
database = "firefighter_svc.db"
log_level = "info"

[service]
grpc_listen_address = ":50051"
nft_managed_table_name = "firefighter_svc_rules"
nft_ip_set_name = "ff_svc_ip_blacklist"
default_rule_ttl = "24h"

[waf]
engine_enabled = true
paranoia_level = 2
owasp_crs_path = "/etc/firefighter/coraza-crs"

[[vhosts]]
domain = "app.example.com"
upstream = "http://localhost:8080"
rate_limit_rps = 100
mtls_required = false

Built With

Go 1.24+

Coraza WAF Engine

OWASP Core Rule Set

NFTables

Kubernetes Ingress Controller

gRPC & ConnectRPC

Embedded NATS JetStream

SQLite & bbolt DB

OpenAPI 3.0

PatternFly & React UI

Prometheus & Grafana

Protect Your Web Infrastructure

Get started with FireFighter for Kubernetes or enterprise Linux environments.

Schedule Consultation Contact Security Team