DEV Community

禾
禾

Posted on

A vs B: Terminate Traffic at the WAF or Forward from a Reverse Proxy

#reverseproxy #upstream #deployment #websecurity

When you add a site to SafeLine, the three required values are Domain, Port, and Upstream (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). SafeLine itself is a self-hosted WAF built as an HTTP/HTTPS reverse proxy: it receives traffic for the original website, removes malicious requests, and forwards the safe remainder to the real application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). This means the placement decision is really a choice about who terminates the public connection before SafeLine sees it.

Option A: Terminate directly at SafeLine
Point the domain's DNS record at the SafeLine server IP. SafeLine listens on the Port value you configured, usually 80 or 443 with SSL enabled for HTTPS, and forwards to the Upstream (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). This gives the shortest path: clients reach the WAF, the WAF inspects the request, and safe traffic goes to the app. It is the simplest layout when nothing else already owns ports 80 and 443 on that host.

Option B: Keep a front reverse proxy
Keep an existing reverse proxy or load balancer as the public listener and have it forward to SafeLine on a different port, after which SafeLine forwards to the Upstream. This preserves existing TLS certificates, health checks, and routing rules, and it lets you cut domains over gradually. The cost is an extra hop and an extra layer to configure.

How to decide

  • If ports 80 and 443 are free on the SafeLine host and you can change DNS, choose Option A.
  • If you must keep existing TLS termination or load balancing, choose Option B and make SafeLine listen on a non-conflicting port.
  • Either way, the console requires the same three fields: Domain, Port, and Upstream, with SSL enabled on the Port for HTTPS (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

After the site is added, verify the protection by sending test requests. The documentation lists common examples such as SQL injection, XSS, path traversal, code injection, and XXE; if SafeLine returns a blocking page, it successfully intercepted the attack (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Do I have to use ports 80 and 443?

No. The Port field is the port SafeLine listens on, such as 80 or 443 (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). You can use another port if those are already taken, especially when SafeLine sits behind an existing front proxy.

Does Option A require changing my DNS?

Yes. After completing the settings, resolve the domain you entered to the IP address of the server where SafeLine is located, then access the application through that domain (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

What should the Upstream field contain?

It is the real address of your original app through which SafeLine forwards traffic (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). It can point to an internal IP, a different port, or the address of the application running behind the WAF.

Is the SSL option tied to the placement?

Yes. The documentation specifies that for HTTPS apps you check the SSL option on the SafeLine listening port (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). In Option A that port is the public TLS endpoint. In Option B the public TLS can stay on the front proxy while SafeLine listens on a plain internal port, so the layout should match where you terminate TLS.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)