Integrating Unblu with the Airlock Web Application Firewall without protected resources
The Airlock Web Application Firewall (WAF) is one of the reverse proxy products specifically supported by Unblu for securing public internet access to on-premises Unblu installations. This article describes how to configure an Airlock WAF that proxies your on-premises Unblu server to your public visitors.
There are two guides for configuring the Airlock WAF. Go through the checklist to choose the appropriate instructions for your use case before you start configuring the Airlock WAF. |
Before you start
Before you start, verify that your current installation meets the requirements to run Unblu with Airlock WAF.
-
For the Unblu server, make a note of following configuration properties:
You need them when you configure the mapping for the Unblu server in the reverse proxy settings.
-
Open the Airlock administration interface and navigate to
. Make sure the version of Airlock WAF you’re using is 5.3 or higher.
Configuring the Airlock WAF
Remember to click on the Activate button once you’ve finished configuring the Airlock WAF. |
Configure the Unblu back-end group
-
In the left sidebar of the Airlock administration interface, navigate to
. -
Create the back-end group for the Unblu server if you haven’t already done so.
-
On the Basic tab, fill in the following details:
-
The Name of the group.
-
The appropriate Protocol.
-
The name of your Unblu server’s Back-end host.
-
The Port the Unblu server uses.
Figure 1. Airlock Unblu back-end group, Basic tab -
Configure the mapping for the Unblu server
Next, create the mapping for the Unblu server. Start with a new empty mapping. Give it a name that makes it clear which environment and version of Unblu it maps and work through the various tabs as outlined below.
The Basic tab
On the Basic tab, make the following changes:
-
In the Service and Mode section, set the Entry path and the Back-end path to the value of Unblu’s
PUBLIC
path prefix as defined in com.unblu.identifier.publicPathPrefix, followed by a trailing slash/
. -
In the Application section, set Session handling to Use available session.
-
Set Passthrough cookies to Use regular expression.
-
In the line below the radio button, add the values of the following configuration properties, separated by an OR (
|
):-
com.unblu.identifier.singleAccountSessionCookieName or com.unblu.identifier.multiAccountSessionCookieName, depending on whether you have multiple accounts set up on your Unblu server.
With the default values for the configuration properties listed above, the regular expression looks like this:
Listing 1. Regular expression for passthrough cookies with default valuesx-unblu-session | x-unblu-device
The default values for the configuration properties above contain variables. In the regular expression, you must replace the variable with its value, like in the example above. -
When you’ve finished, the Basic tab should look like this:

The Request Actions tab
On the Request Actions tab, complete the following steps:
-
Create a custom copy of the (default) Request header whitelist.
-
Adapt the name and add the following headers to the Header Name Pattern:
-
x-unblu-client
-
x-unblu-page
-
x-unblu-referer
-
x-unblu-xui
Separate the header names with an OR (
|
). -
-
Make sure you have an action that adds an
X-Forwarded-Proto
header to all requests. The action should look something like this:Request action to add or replace anX-Forwarded-Proto
header to requests -
Create an action that adds an
X-Forwarded-Host
header to all requests. The action should look similar to the one that adds anX-Forwarded-Proto
header.
The Response Actions tab
On the Response Actions tab, create a custom copy of the (default) Response header whitelist. Adapt the name and make sure that the Header Name Pattern includes the following headers:
-
Pragma
-
Cache-Control
-
Expires
-
x-unblu-xui
-
x-unblu-client
-
x-unblu-page
-
x-unblu-start-time
Add any missing headers to the pattern with an OR (|
).
See also
-
For more information on the Airlock WAF, see the Airlock knowledge base and the Airlock machine sizing page.