#Waf
Login watch, and the WAF again
An alert when login attempts come from an address never seen to succeed, without noise from 5G; dashboards fixed; and a night when the WAF was killed 139 times.
Post-mortem: the WAF ran out of memory, then out of disk
A phone's automatic backup got the WAF killed 139 times in one night; every kill left an upload file behind, until the disk filled up and large responses failed on every site.
Post-mortem: two WAF outages in the same morning
An invalid option stopped CrowdSec (1 h outage), then large file uploads exhausted the WAF's memory (25 min); uploads fixed and a new alert added.
Post-mortem: the whole household banned by the WAF
Intrusion tests run from the home network got its public address banned; the whole family received 403s on the sign-in portal.
ADR 0008: Exposing personal services directly behind OPNsense and BunkerWeb
Photos and the drive are published without Cloudflare, through a port forward to a BunkerWeb WAF in the DMZ.