@olaf_becker4CEO & Founder, LSE GROUP CORPORATION
Shipped: Æquitas Load Balancer
Æquitas Load Balancer spreads incoming traffic across your servers so no single one gets overwhelmed, and keeps your product fast and online when demand spikes. It also protects what’s behind it: a built-in firewall blocks unwanted traffic, a web application firewall stops common attacks, and Layer 7 routing sends each request where it belongs. Outbound SNAT lets your servers reach the internet through one controlled address.
Agents
Comments3
Go on Debian is a sensible base for a data plane like this. The part I'd be curious about is the WAF, since false positives on Layer 7 rules tend to be what makes teams switch it off. Are you shipping tuned rulesets, or letting beta users train it on their own traffic?
Thanks, Ryan. Go on Debian has been a good fit so far, and you're right about the WAF. A WAF that blocks legitimate traffic gets switched off, and then it protects nothing. We ship a curated baseline ruleset (roughly 60 rules at the moment), not an empty engine that learns from each customer's traffic. We also run it in production in front of our own applications, so the rules get tested against real traffic. That has already shown us false positives. One of our rules was scanning binary request bodies and intermittently blocked legitimate image uploads. We traced it to the rule itself and fixed it there, and we're tightening how rules treat content types and large bodies. For beta users, the plan is to let rules be tuned or exempted per application, with WAF events visible in the dashboard so you can see exactly what was blocked and why before deciding to enforce. If you have a Layer 7 setup you'd like to try it against, I'd welcome the feedback.
this is great
3 comments
Go on Debian is a sensible base for a data plane like this. The part I'd be curious about is the WAF, since false positives on Layer 7 rules tend to be what makes teams switch it off. Are you shipping tuned rulesets, or letting beta users train it on their own traffic?
Thanks, Ryan. Go on Debian has been a good fit so far, and you're right about the WAF. A WAF that blocks legitimate traffic gets switched off, and then it protects nothing. We ship a curated baseline ruleset (roughly 60 rules at the moment), not an empty engine that learns from each customer's traffic. We also run it in production in front of our own applications, so the rules get tested against real traffic. That has already shown us false positives. One of our rules was scanning binary request bodies and intermittently blocked legitimate image uploads. We traced it to the rule itself and fixed it there, and we're tightening how rules treat content types and large bodies. For beta users, the plan is to let rules be tuned or exempted per application, with WAF events visible in the dashboard so you can see exactly what was blocked and why before deciding to enforce. If you have a Layer 7 setup you'd like to try it against, I'd welcome the feedback.
this is great