OPENWAF
EspañolES Request early access Menu
How it works

From nameservers to origin

The path a request takes through OpenWAF, and how configuration reaches the edge safely.

How a request reaches your site through OpenWAFA visitor looks up the domain on your OpenWAF nameservers, connects over HTTPS to an OpenWAF edge node in Germany, which applies TLS, the WAF, rate limits and the access gate, and forwards only allowed requests to your origin. The control plane sends the edge nodes configuration signed with Ed25519.VisitorBrowser or appYour nameserversfaros.ns.openwaf.devpolaris.ns.openwaf.devOpenWAF edge · GermanyTLS with Let’s Encrypt certificatesWAF · rate limits · access gateIP, country and threat-feed rulesControl planeVersions, history, rollback and audit logYour originAny server, any stack1 · DNS2 · HTTPS3 · AllowedSigned config · Ed25519How a request reaches your site through OpenWAFA visitor looks up the domain on your OpenWAF nameservers, connects over HTTPS to an OpenWAF edge node in Germany, which applies TLS, the WAF, rate limits and the access gate, and forwards only allowed requests to your origin. The control plane sends the edge nodes configuration signed with Ed25519.VisitorBrowser or app1 · DNSYour nameserversfaros.ns.openwaf.devpolaris.ns.openwaf.dev2 · HTTPSOpenWAF edge · GermanyTLS with Let’s Encrypt certificatesWAF · rate limits · access gateIP, country and threat-feed rules3 · AllowedEd25519Your originYour serverControl planeVersions · audit
Proxied hostnames resolve to our edge nodes; DNS-only records are answered exactly as you define them.

1. Nameservers

Every account receives a fixed pair of nameservers under ns.openwaf.dev. Delegating a domain to that pair is the only change needed at the registrar.

  • Your pair

    For example faros.ns.openwaf.dev and polaris.ns.openwaf.dev. The same pair serves all your domains, so every client gets the same instructions.

  • Activation

    When the domain’s delegation points to your pair, the zone becomes active and certificates are requested for its proxied hostnames.

  • If the delegation goes away

    If a domain stops pointing to your pair, its zone stops being active, so nobody keeps serving a domain they no longer control.

2. DNS

A hidden primary holds your zones; public secondaries in Germany answer the queries.

  • Proxied records

    Answered with the addresses of our edge nodes, so traffic passes through the WAF.

  • DNS-only records

    Answered exactly as you define them: mail, verification records and services that shouldn’t be proxied.

  • No anycast yet

    Today all our DNS servers are in Germany. More locations are planned.

3. Edge nodes

Edge nodes in Germany terminate TLS, apply each site’s rules and forward allowed requests to your origin.

  • TLS at the edge

    Let’s Encrypt certificates, issued and renewed automatically.

  • Inspection

    WAF rules, the access gate, IP and country rules and rate limits, in front of every proxied hostname.

  • Forwarding

    Allowed requests go on to the origin you configure, within the site’s request size and time-out limits.

4. Signed configuration

The control plane turns each version of your configuration into a document signed with Ed25519.

  • Verified on every node

    Nodes check the signature before applying a document and reject anything that doesn’t verify.

  • Versioned

    Each document matches a version with its history, diff, author and reason.

  • Propagation in under a minute

    New versions reach all edge nodes in under a minute.

5. When something fails

The edge is designed to keep working when the control plane doesn’t.

  • Last valid configuration

    If nodes can’t reach the control plane, they keep serving with the last valid configuration they received.

  • Rollback

    If a change causes trouble, roll back to the previous version in one step.

  • Log-only first

    Try stricter rules in log-only mode before enforcing them.

Bring your agency’s sites into early access

OpenWAF is free with no limits while it is in early access. Tell us about your agency and the sites you manage, and we will set up your account and your nameserver pair.

Request early access