NNumbers WAF

The NNumbers WAF is a layer 7 web application firewall for websites and APIs. It sits in front of your origin, on the NNumbers edge, and inspects every HTTP request before handing it to your server: whatever matches an attack rule is blocked or logged, according to the policy mode.

Everything is managed in the NNumbers Console: domains, policy, custom rules, rate limiting, events and exceptions. You install nothing on the origin and change no application code.

Overview

The WAF runs the OWASP Coraza 3.8.1 engine with the OWASP Core Rule Set 4.25.2 (LTS), the rule set maintained by the OWASP community that describes, in versioned rules, what known attacks look like.

Item	What it is
Engine	OWASP Coraza 3.8.1
Rule set	OWASP Core Rule Set 4.25.2, LTS release
Where it runs	On the NNumbers edge, in front of your origin
Where you manage it	NNumbers Console
What it protects	HTTP and HTTPS websites and APIs

The service is shared across organizations, with isolation per organization: each organization only sees and changes its own domains, policies, rules and events.

How it works

Every request follows the same path:

client → NNumbers edge → WAF inspection → your origin

1. NNumbers edge. The first stop: it terminates TLS, applies the platform HTTP protections and the rate limiting.
2. WAF inspection. The request is checked against the platform controls, your custom rules and the OWASP rule set. The decision (allow, log or block) is made here.
3. Your origin. Only the allowed request reaches the server you set when registering the domain.

The edge keeps the last valid configuration: if the Console is unavailable, protection keeps running with what was already applied, and pending changes apply when it comes back.

What it protects

The OWASP rule set covers the most common attack families against web applications and APIs:

Family	Examples
SQL injection	' OR 1=1 --, UNION SELECT, injection in parameters and cookies
Cross-site scripting (XSS)	Script in a parameter, a header or an HTML body
Remote code execution	System command injection, reverse shell
Local file inclusion (LFI) and path traversal	../../etc/passwd, file wrapper
Remote file inclusion (RFI)	Including a file hosted outside the application
PHP and Java injection	PHP function injection, Java deserialization
Protocol attacks and anomalies	Malformed request, duplicated header, suspicious method
Scanners and crawlers	Automated sweep for known panels and files
Session fixation	Session identifier injection
Multipart abuse	Malformed multipart body or too many parts

Limitations

• It does not stop volumetric layer 3 and layer 4 attacks (UDP or SYN floods, link saturation). That defense belongs to the network in front, outside the WAF.
• It does not inspect the response body. The WAF looks at the request; what your application returns is not evaluated.
• WebSocket passes, but is not inspected after the upgrade. Streaming (SSE) also passes.
• A body above the policy limit is rejected with 413, not silently allowed. The default is 64 KiB per request, and the maximum a policy can declare is 1 MiB; for larger uploads, use the body inspection exemption.
• Content types outside the OWASP list are blocked at paranoia level 1 (rule 920420). A text/plain or a vendor +json may need an exception.
• Rate limits apply per edge instance, so the effective global value can be higher than configured. See Rate limiting.
• The WAF does not fix the application. It reduces exposure to known attacks; a vulnerability in your code remains yours.

How the protections differ

Protection	What it does	When to use it
NNumbers WAF	Inspects the HTTP request and blocks known attacks	Whenever a website or API is exposed
API Gateway quotas	Limits consumption per consumer and per API key	API usage contracts, billing, fair use
Network firewall	Allows or blocks port and source address	Exposing only the required ports
Volumetric DDoS protection	Absorbs traffic volume in the network	Volume attacks, link saturation

They are different, complementary layers: the WAF does not replace the network firewall or the volume protection, and it consumes no API Gateway quota.

Next steps

• Getting started — from domain to active protection.
• Domains — registration, ownership verification, certificate and DNS.
• Policies — operating modes and paranoia level.