1# Replace the following
 2location ~ \.php$ {
 3  (...)
 4}
 5
 6# With
 7location / {
 8  proxy_set_header X-Real-IP $remote_addr;
 9  proxy_set_header X-Forwarded-Host $server_name;
10  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
11  proxy_set_header X-Forwarded-Proto $scheme;
12  proxy_pass http://localhost;
13}

 1server {
 2  listen localhost:80 default_server;
 3
 4  # WordPress installation root directory
 5  root /usr/share/nginx/html;
 6
 7  # Index files
 8  index index.php;
 9
10  # Make nginx play nice with WordPress permanent links
11  location / {
12    try_files $uri $uri/ /index.php?$args;
13  }
14
15  # Pass the requests to PHP
16  location ~ \.php$ {
17    (...)
18  }
19}

1#!/bin/bash
2tcpdump -i lo "port 80"

 1#!/usr/sbin/nft -f
 2table ip filter {
 3  # Firewall
 4  chain firewall-input {
 5    type filter hook input priority 0;
 6    (...)
 7  }
 8  chain firewall-output {
 9    type filter hook output priority 0;
10    (...)
11  }
12  # IPS
13  chain ips-input {
14    type filter hook input priority 10;
15
16    # Queue input packets to Suricata
17    counter queue num 0-1 fanout, bypass
18  }
19  chain ips-output {
20    type filter hook output priority 10;
21
22    # Queue output packets to Suricata
23    counter queue num 0-1 fanout, bypass
24  }
25}

 1# Activate workers run mode
 2runmode: workers
 3
 4# Enable EVE logging with X-Forward-For support
 5- eve-log:
 6    enabled: yes
 7    # ...
 8    types:
 9      - alert:
10          # ...
11          xff:
12            enabled: yes
13            # Two operation modes are available, "extra-data" and "overwrite".
14            mode: overwrite
15            # Two proxy deployments are supported, "reverse" and "forward". In
16            # a "reverse" deployment the IP address used is the last one, in a
17            # "forward" deployment the first IP address is used.
18            deployment: reverse
19            # Header name where the actual IP address will be reported, if more
20            # than one IP address is present, the last IP address will be the
21            # one taken into consideration.
22            header: X-Forwarded-For
23
24# Disable Netfilter queue fail open
25nfq:
26  fail-open: no
27
28# Configure CPU affinity
29threading:
30  # ...
31  set-cpu-affinity: yes
32  # Tune cpu affinity of suricata threads. Each family of threads can be bound
33  # on specific CPUs.
34  cpu-affinity:
35    - management-cpu-set:
36        cpu: [ 0, 1 ]  # include only these cpus in affinity settings
37        mode: "balanced"
38        prio:
39          default: "high"
40    # ...
41    - detect-cpu-set:
42        cpu: [ 0, 1 ]
43        mode: "exclusive" # run detect threads in these cpus
44        # Use explicitely 3 threads and don't compute number by using
45        # detect-thread-ratio variable:
46        # threads: 3
47        prio:
48          # low: [ 0 ]
49          # medium: [ "1-2" ]
50          # high: [ 3 ]
51          default: "high"
52
53# Edit the HOME_NET to contain the localhost address
54vars:
55  # ...
56  address-groups:
57    HOME_NET: "[127.0.0.1,(...)]"
58
59# Edit the host OS policy to contain the localhost address
60host-os-policy:
61  # ...
62  linux: [127.0.0.1]

1# Make Suricata listen for packets in the Netfilter queues
2OPTIONS="-q 0 -q 1 "

1https://external.domain/?p=')) UNION SELECT 1--