DEV Community

Arina Cholee
Arina Cholee

Posted on

Why I Recommend You to Migrate from Cloudflare to SafeLine WAF

#websecurity #cybersecurity #waf #safeline

Making the switch from a cloud-based WAF like Cloudflare to a self-hosted WAF solution such as SafeLine might sound like a big leap, but for many developers and teams, it’s a no-brainer when it comes to control, privacy, and customization. If you’ve been feeling limited by Cloudflare’s templates or concerned about where your data resides, self-hosting could be the perfect solution.

This guide will walk you through the process of migrating from a cloud WAF to SafeLine, help you avoid common pitfalls, and share useful tips to make the transition as smooth as possible.

Why Migrate to a Self-Hosted WAF?

Benefits of Moving Away from Cloudflare:

While cloud WAFs like Cloudflare are convenient, they come with a set of limitations:

  • Data Residency Concerns: Traffic passes through third-party servers, which can be a dealbreaker for sensitive data.
  • Limited Customization: You get basic templates, but customization of rules is often limited.
  • Latency & Dependency: Using external proxies introduces potential delays and single points of failure.

With SafeLine WAF, you run it entirely on your own infrastructure, which means:

  • Full control over traffic flow and security policies.
  • Granular bot protection and rate-limiting.
  • Customizable rules per endpoint for better protection.
  • Complete visibility into logs and analytics, so you’re always in the loop.

Step 1: Assess Your Current Setup

Before jumping into the migration, it’s important to take inventory of your current Cloudflare setup to avoid missing anything important. Make sure to:

  • DNS setup: Note any proxied subdomains and CNAME records.
  • Rules & Policies: Export IP blocklists, rate-limits, and bot protection settings.
  • SSL/TLS Config: Identify certificates used for your domains.
  • Logging & Analytics: Determine what logs you need to preserve or replicate.

This gives you a solid starting point before diving into the setup process.

Step 2: Prepare Your SafeLine Environment

Since SafeLine is a self-hosted solution, you’ll need a Linux server to get started. Here are the recommended specs:

  • CPU: 4+ cores
  • RAM: 8+ GB
  • Storage: SSD for optimal performance (especially for logs)

Install SafeLine: 

# Pull SafeLine Docker image
docker pull safeline/waf:latest

# Start SafeLine container
docker-compose up -d
Enter fullscreen mode Exit fullscreen mode
  1. Verify that your server is reachable and that ports 80/443 are open.

Step 3: Configure SSL/TLS

Cloudflare usually handles SSL termination at the edge. With SafeLine, you’ll have full control over SSL. SafeLine supports both Let’s Encrypt and custom certificates.

Once configured, SafeLine will serve traffic securely, without relying on Cloudflare’s proxy.

Step 4: Recreate Rules & Policies

Now it’s time to bring over your existing Cloudflare settings. You’ll want to:

  • Import IP allow/block lists: Import previous blocklists directly into SafeLine.
  • Rate limiting: Set up endpoint-specific rate-limits.
  • Bot protection: Enable JS/CAPTCHA challenges where necessary.
  • Custom rules: SafeLine allows regex-based matching for fine-tuned control.

Example:

# Limit /api/login to 5 req/sec per IP
docker exec -it safeline-cli set-rule /api/login rate-limit 5
Enter fullscreen mode Exit fullscreen mode

Step 5: DNS Cutover

  1. Point your A/AAAA record to your SafeLine server.
  2. Temporarily disable Cloudflare’s proxy (switch the orange cloud to a grey one) and test traffic flow.
  3. Monitor SafeLine logs for any errors or blocked requests.

Tip: Start with a staging subdomain to test the rules before fully cutting over your production traffic.

Step 6: Monitoring & Fine-Tuning

After going live, it’s time to fine-tune your setup:

  1. Tail access logs to check for bot detection: 
  tail -f /data/safeline/logs/nginx/safeline/access.log | grep "bot"
Enter fullscreen mode Exit fullscreen mode

  1. Monitor CPU and memory usage.

  2. Adjust custom rules based on real traffic patterns to optimize bot protection and rate-limiting.

Key Considerations

  • Server Maintenance: Since SafeLine is self-hosted, you’ll be responsible for server upkeep, backups, and uptime.
  • Granular Control: While SafeLine offers greater flexibility, it requires careful tuning to avoid misconfigurations.
  • Migration Period: Consider running both Cloudflare and SafeLine in parallel for a while to ensure a smooth transition.

Developer Takeaways

  • Full Control: Self-hosting means you control everything, with no third-party dependency.
  • Detailed Logs: SafeLine provides rich logs for security audits, which Cloudflare doesn’t offer at the same level.
  • Endpoint-Specific Policies: Fine-tune your bot protection based on real-time traffic data.
  • CI/CD Integration: SafeLine integrates seamlessly into CI/CD pipelines for automated security.

Conclusion

Migrating from a cloud WAF to a self-hosted solution like SafeLine may seem complex at first, but the benefits—complete ownership, improved privacy, and more customization—make it worthwhile. By following the steps above, you can smoothly transition and ensure your application is fully protected while maintaining control over your security policies.

Links:

Top comments (0)