• BotGuard Nginx module
• HTTP/3 (QUIC)
• OpenSSL 3.0
• TLS 1.3
• Brotli compression
• SSL management (Let’s Encrypt, Buypass)
• Content caching
• L7 DDoS protection
• Client rate limiting

Batteries included! Everything works out of the box and you can start using it with zero SSH/console experience. The application is managed via web application.

Getting Started

Configuration

The configuration of the BotGuard GateKeeper is done via browser. As a prerequisite, you will need an API key, which is available at your BotGuard dashboard.

In your browser address bar, type the IP address of the deployed GateKeeper instance and hit enter: http://your.instance.ip.address. Then, the web application will ask you to enter your BotGuard API key or register a new BotGuard account to get one. The API key will be used as a password for further GateKeeper management.

After entering a valid API key, the page will refresh and prompt you to enter the username and the password. Use ‘botguard’ as a username, and your API key as a password.

Domain Setup

1. Select ‘Domains’ in the top menu
2. Click the ‘Add domain’ button
3. Enter your web application domain name, add subdomains, if any
4. Define your application servers addresses in the ‘Upstreams’ section. BotGuard GateKeeper will try to guess your upstream addresses based on the domain DNS records
5. Select your preferred SSL certificate vendor or upload your own certificate

6. Select additional caching and security settings (don’t forget to enable bot protection) and save the changes

7. Point your domain A/AAAA records to the BotGuard GateKeeper instance IP address.

Upon the completion of these steps, the GateKeeper will issue an SSL certificate for your site and the traffic will start flowing through the BotGuard GateKeeper to your upstream hosts.

SSL Certificates

BotGuard GateKeeper takes care of your website SSL certificate. It will issue a new certificate upon changing the DNS record, or you could upload your own certificate. BotGuard GateKeeper supports Let’s Encrypt and Buypass as SSL certificate vendors. It also might enable HTTP/3 (QUIC) protocol with TLS 1.3 encryption and optimized security settings, which will help you to get A+ score with Qualys SSL Labs online test.

L7 DDoS Protection

Basic Protection

Mitigate DDoS attacks or server overuse by limiting the number of simultaneous connections and rate of requests.

Advanced Protection

A visitor that triggered any of the protection rules from your site settings will be added to the blacklist at server firewall for 1 hour and, hence, unable to send any new requests to the server.

List blocked IP addresses

$ ipset list blackhole4 # Use ‘blackhole6’ for IPv6 addresses

Add/Remove IP addresses from blacklist

$ ipset add blackhole4 1.2.3.4 # Use ‘blackhole6’ for IPv6 addresses

$ ipset del blackhole4 1.2.3.4 # Use ‘blackhole6’ for IPv6 addresses

Advanced Firewall Setup

Firewall settings block packets sent from private IPv4 subnets by default. However, such networks are used by the cloud providers infrastructure sometimes. The file /etc/iptables/rules.v4 already contains the rules to ignore some subnets when using certain cloud services. You might need to adjust these settings when using custom VPC networks.

Release Notes

• 1.1.3 Nginx 1.23.3 (mainline), OCSP stapling fixes, cache optimization
• 1.1.2 Fix for SSL upstreams with SNI, display number of blocked IP addresses in dashboard
• 1.1.1 Optimized Nginx performance
• 1.1.0 External Redis support for clustering purposes, tuning limits
• 1.0.2 OpenSSL upgraded to 3.0.7 version with security bugfix
• 1.0.1 Nginx default parameters update. Fixed Nginx logrotate settings
• 1.0.0 Initial release