DEV Community

Lia
Lia

Posted on • Edited on

How to Replace Cloudflare WAF with a Self-Hosted Alternative

If you're paying for Cloudflare Pro or Business just for the WAF, or you're on the free tier and want actual protection, here's how to migrate to a self-hosted solution.

Step 1: Figure Out Why You're Switching

Reason What SafeLine Does Instead
Free tier detection too weak (10.7%) Community Edition: 71.65% at $0
Don't want to pay $20-200/month Community Edition is completely free
Data privacy — third-party TLS termination Traffic stays on your server
Need more than 5 custom rules Unlimited custom rules with regex
Want per-route bot control Bot protection configurable per route

Step 2: Deploy SafeLine

On any Linux server with Docker:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Enter fullscreen mode Exit fullscreen mode

This pulls the Docker images — Tengine reverse proxy, the semantic analysis engine, PostgreSQL for config and logs. Takes about 3 minutes. Access the dashboard at https://<your-server-ip>:9443.

Step 3: Route Traffic Through SafeLine

SafeLine binds ports 80/443 by default. If you already have a proxy on those ports, set SafeLine to an internal port:

Internet → Nginx/Caddy (443) → SafeLine (port 5080) → Your App (port 3000)
Enter fullscreen mode Exit fullscreen mode

Or let SafeLine be the primary reverse proxy:

Internet → SafeLine (443) → Your App (port 3000)
Enter fullscreen mode Exit fullscreen mode

Step 4: Add Your Sites

In the SafeLine dashboard, add each domain and point it to your backend IP and port. The semantic engine starts protecting immediately — no rule tuning needed.

Step 5: Recreate Your Cloudflare Rules

Cloudflare Rule SafeLine Equivalent
IP block IP blacklist in dashboard
Rate limit (1 rule on free) Unlimited rate limit rules
Country block (Enterprise) GeoIP blocking — free
JS Challenge JS/Captcha/Cookie Challenge
Custom rules (5 max, no regex) Unlimited rules, full regex
Bot Fight Mode (global only) Bot protection per route

Step 6: DNS Cutover

If you're using Cloudflare's orange-cloud proxy, switch to grey-cloud (DNS only) or point nameservers back to your registrar. The WAF now lives on your server.

Step 7: Keep Cloudflare for CDN/DDoS (Optional)

You don't have to remove Cloudflare entirely:

User → Cloudflare DNS/CDN → SafeLine WAF → Your App
Enter fullscreen mode Exit fullscreen mode

Cloudflare handles edge caching and DDoS. SafeLine handles application-layer detection. They complement each other.

Read the full comparison: SafeLine vs Cloudflare WAF: An Honest, Detailed Comparison — benchmark data, pricing breakdown, and when to use which.


FAQ

Will my site go down during the switch?

No. Deploy SafeLine, test with a staging subdomain, then cut over. You can run both simultaneously.

Do I need to change DNS?

Only if you want to stop using Cloudflare's proxy. You can keep Cloudflare for DNS only.

What about SSL?

SafeLine integrates with Let's Encrypt. Or terminate TLS at your existing reverse proxy and forward to SafeLine.


How much are you currently paying Cloudflare, and what's the main feature you'd miss?


Try SafeLine yourself: Live Demo | Website | Deploy Guide | Discord Community | More from CyberServal | LinkedIn

Top comments (0)