Auditing Local WAF Rules: Identifying Firewall Bypasses on Pakistan VPS Infrastructures

When deploying mission-critical applications on a high-speed NVMe KVM VPS, simply placing a Web Application Firewall (WAF) like Cloudflare or Sucuri in front of your domain is not enough. If your origin server is not properly hardened, attackers can completely bypass the edge network and send malicious payloads directly to your server’s IP address.

In this technical guide, we will explore common firewall bypass techniques and how to audit your local VPS security rules to prevent them.

1. The Threat of Origin IP Exposure

The most common WAF bypass occurs when an attacker discovers the real IP address of your origin server. They can find this through:

• Historical DNS records (e.g., SecurityTrails)
• Shodan or Censys scans that index your server’s SSL certificate
• Outbound server connections (like emails or pingbacks) revealing the IP

Once the attacker has your IP, they can modify their local hosts file to point your domain directly to the VPS IP, entirely skipping the WAF’s protection layer. This exposes your server to SQL injections, brute-force attacks, and DDoS attempts that can lead to a 502 Bad Gateway Error.

2. Auditing Your Local Firewall (CSF/iptables)

To prevent this, you must configure your local firewall to strictly drop any HTTP/HTTPS traffic that does not originate from your WAF’s verified IP ranges.

Verifying Allowed Networks

If you are using ConfigServer Security & Firewall (CSF), you should audit your /etc/csf/csf.allow and /etc/csf/csf.deny files.

Run the following command to check if port 80 or 443 are globally open in your TCP_IN directive:

grep "TCP_IN" /etc/csf/csf.conf

If you see 80 or 443 in that list, your server is vulnerable to direct IP attacks. You must remove those ports from the global list and explicitly allow only the WAF IPs.

Whitelisting WAF Providers

For a provider like Cloudflare, you must add their IPv4 and IPv6 ranges to your firewall using advanced port filtering in csf.allow:

# Allow Cloudflare IPs
tcp|in|d=80|s=103.21.244.0/22
tcp|in|d=443|s=103.21.244.0/22

Restart CSF to apply the changes:

csf -r

3. Hardening Local Nginx/Apache Configurations

Even with firewall rules in place, you should configure your web server to only accept requests that contain the correct Host header. If someone connects via the raw IP address, the server should drop the connection immediately.

Nginx Strict Host Routing

In Nginx, create a default server block that returns a 444 (Connection Closed Without Response) for unrecognized host headers:

server {
    listen 80 default_server;
    listen 443 ssl default_server;
    server_name _;
    
    # Dummy SSL cert for the default block
    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

    return 444;
}

This ensures that tools like Shodan scanning the raw IP address won’t receive your actual SSL certificate, keeping your origin hidden and preventing issues like Mixed Content Errors.

Conclusion

Securing a VPS requires a defense-in-depth approach. By strictly controlling network access at the firewall level and enforcing strict Host header validation in your web server, you can guarantee that all traffic flows exclusively through your WAF, ensuring maximum security and compliance.