GateKeeper Quick Start
GateKeeper Quick Start
BotGuard GateKeeper is a protective reverse proxy built around BotGuard bot and hackers detection technology. The core of the product is a Nginx web server which proxies the requests from the outer web to your server, hiding it from bots, hacker attacks, and other kinds of unwanted visitors. We use customized Nginx build that offers additional features:
- BotGuard Nginx module
- HTTP/3 (QUIC)
- OpenSSL 3.0
- TLS 1.3
- Brotli compression
- SSL management (Let’s Encrypt, Buypass)
- Content caching
- L7 DDoS protection
- Client rate limiting
Batteries included! Everything works out of the box and you can start using it with zero SSH/console experience. The application is managed via web application.
The configuration of the BotGuard GateKeeper is done via browser. As a prerequisite, you will need an API key, which is available at your BotGuard dashboard.
In your browser address bar, type the IP address of the deployed GateKeeper instance and hit enter: http://your.instance.ip.address. Then, the web application will ask you to enter your BotGuard API key or register a new BotGuard account to get one. The API key will be used as a password for further GateKeeper management.
After entering a valid API key, the page will refresh and prompt you to enter the username and the password. Use ‘botguard’ as a username, and your API key as a password.
- Select ‘Domains’ in the top menu
- Click the ‘Add domain’ button
- Enter your web application domain name, add subdomains, if any
- Define your application servers addresses in the ‘Upstreams’ section. BotGuard GateKeeper will try to guess your upstream addresses based on the domain DNS records
- Select your preferred SSL certificate vendor or upload your own certificate
- Select additional caching and security settings (don’t forget to enable bot protection) and save the changes
- Point your domain A/AAAA records to the BotGuard GateKeeper instance IP address.
Upon the completion of these steps, the GateKeeper will issue an SSL certificate for your site and the traffic will start flowing through the BotGuard GateKeeper to your upstream hosts.
BotGuard GateKeeper takes care of your website SSL certificate. It will issue a new certificate upon changing the DNS record, or you could upload your own certificate. BotGuard GateKeeper supports Let’s Encrypt and Buypass as SSL certificate vendors. It also might enable HTTP/3 (QUIC) protocol with TLS 1.3 encryption and optimized security settings, which will help you to get A+ score with Qualys SSL Labs online test.
L7 DDoS Protection
Mitigate DDoS attacks or server overuse by limiting the number of simultaneous connections and rate of requests.
A visitor that triggered any of the protection rules from your site settings will be added to the blacklist at server firewall for 1 hour and, hence, unable to send any new requests to the server.
List blocked IP addresses
$ ipset list blackhole4 # Use ‘blackhole6’ for IPv6 addresses
Add/Remove IP addresses from blacklist
$ ipset add blackhole4 126.96.36.199 # Use ‘blackhole6’ for IPv6 addresses
$ ipset del blackhole4 188.8.131.52 # Use ‘blackhole6’ for IPv6 addresses
Advanced Firewall Setup
Firewall settings block packets sent from private IPv4 subnets by default. However, such networks are used by the cloud providers infrastructure sometimes. The file /etc/iptables/rules.v4 already contains the rules to ignore some subnets when using certain cloud services. You might need to adjust these settings when using custom VPC networks.
- 1.1.3 Nginx 1.23.3 (mainline), OCSP stapling fixes, cache optimization
- 1.1.2 Fix for SSL upstreams with SNI, display number of blocked IP addresses in dashboard
- 1.1.1 Optimized Nginx performance
- 1.1.0 External Redis support for clustering purposes, tuning limits
- 1.0.2 OpenSSL upgraded to 3.0.7 version with security bugfix
- 1.0.1 Nginx default parameters update. Fixed Nginx logrotate settings
- 1.0.0 Initial release
Head of SoC @BotGuard
konstantin (at) botguard.ee
Comments for this post are closed.