Bridge WAF
Cloud WAF, appliance or host-based: where the WAF sits
A web application firewall can be deployed in three places: as a cloud WAF run by a provider in front of your site, as a network appliance in your own data centre, or as a host-based module inside the web server. The rules can be the same in all three. What changes is who runs it, what traffic it sees before it reaches you, and how much work it takes to keep it current.
Quick facts
- Cloud WAF
- Run by a provider at the edge; traffic reaches it before your network
- Network appliance
- Hardware or virtual device in your network, in front of web servers
- Host-based WAF
- A module in the web server or application runtime
- Same job in all three
- Inspecting requests before the application handles them; see OWASP on WAFs
- Deciding factors
- Who operates it, TLS termination, latency, scale, and what else must sit in front
What a WAF is, and what it is not, is on what is a web application firewall. Choosing DDoS protection is a different decision, covered on cloud vs on-premise DDoS protection.
Cloud WAF vs appliance vs host-based compared
| Model | Who runs it | Sees traffic before your link | TLS | Scales with |
|---|---|---|---|---|
| Cloud WAF | The provider; you configure | Yes | Terminated at the provider | The provider's network |
| Network appliance | You | No | Terminated on the appliance, with your keys | Hardware you buy |
| Host-based WAF | You, per server | No | Already decrypted by the server | The number of servers |
No model is better in general. The table shows the trade: the further out the WAF sits, the less you operate and the more you trust the operator.
Cloud WAF and WAF as a service
A cloud WAF, also sold as WAF as a service or a managed WAF, sits in a provider's network in front of your site. You point DNS at it; it inspects requests and forwards the rest to your origin. Rule updates, capacity and availability are the provider's job.
The costs are trust and reach. The provider decrypts your traffic, so it handles your certificates and your users' data. And the origin must accept traffic only from the provider; if its address is known, attackers go around the WAF.
Network-based WAF appliances
A WAF appliance, physical or virtual, sits in your network in front of the web servers, often next to the load balancer. It keeps TLS keys and traffic inside your perimeter, which matters for some regulated environments, and its latency is low.
You buy it, size it, patch it and update its rules. It sees only what reaches your network, so it shares the network's limits during a flood.
Host-based web application firewalls
A host-based WAF runs inside the web server or the application runtime, for example as a server module loading a shared rule set; ModSecurity is the best-known engine of this kind. It sees decrypted requests with full context, and costs nothing extra to deploy.
It also uses the same CPU and memory as the application, so heavy inspection slows the site, and every server needs the same configuration kept in step.
How to choose a WAF architecture
- Who will operate it? Without staff to tune and patch, a managed cloud WAF avoids a box nobody updates.
- Where must keys and data stay? Regulation may decide between the provider's network and your own.
- What else needs to sit in front? If you already use an edge network for delivery, its WAF adds no new hop. Bundles of a WAF with API, bot and DDoS defences are compared on WAF vs WAAP.
- How will you introduce it? In any model, start by observing; see monitor mode.
Questions
What is a cloud WAF?
A cloud WAF is a web application firewall run by a provider in its own network in front of your site; traffic is pointed at it through DNS, inspected, and forwarded to your origin.
What is the difference between a cloud WAF and a WAF appliance?
A cloud WAF is operated by a provider and sits ahead of your network; an appliance is hardware or a virtual device you run in your own network, keeping keys and traffic inside it.
What is a host-based WAF?
A host-based WAF runs as a module inside the web server or application runtime, inspecting decrypted requests with full context but using the same resources as the application.
Which WAF deployment model is best?
It depends on who will operate it, where keys and data must stay, and what already sits in front of the site. Many sites use a cloud or edge WAF; regulated environments often keep an appliance.