Open-source F5 alternatives

SafeLine is a self-hosted web application firewall (WAF) from Chaitin, released under the GPL-3.0 license. It sits in front of a web application as a reverse proxy, so visitors' requests pass through it first. It filters, monitors, and blocks malicious HTTP and HTTPS traffic before that traffic reaches the origin server, and it is also meant to stop unauthorized data from leaving the application.

The firewall targets common web attack classes, including SQL injection, cross-site scripting, command and code injection, server-side request forgery, path traversal, XXE, and remote code execution, as well as brute-force attempts, HTTP floods, and abusive bots. Beyond rule-based filtering, its documented core capabilities include IP-based rate limiting, a web access control list, bot defense, and encryption of the HTML and JavaScript code served to clients.

Security and operations teams that run their own websites or APIs can use it to add a protective layer in front of existing applications. The project is written in Go and hosted on GitHub, and the maintainers provide documentation, a live demo, and a Discord community. Because it is self-hosted, traffic inspection stays on infrastructure you control.

BunkerWeb is an open-source web application firewall that protects web services and aims to make them secure by default. It is a complete web server based on NGINX that sits in front of your applications as a reverse proxy, filtering traffic before it reaches them.

It can be deployed in Linux, Docker, Swarm and Kubernetes environments and is configurable through a command line or a web user interface. Core security features ship in the box, and additional ones can be added with a plugin system. Related topics in the repository include ModSecurity, anti-bot protection, DNS blocklists and Let's Encrypt certificate handling.

The software is written mainly in Python and released under the AGPL-3.0 license. The project provides documentation, a demo, community templates, examples and a forum. Its goal is for administrators to get a reasonable level of protection with minimal configuration while keeping room to tune individual settings for their own use cases.

ModSecurity is an open-source, cross-platform web application firewall engine. It started as an Apache module and now serves Apache, IIS and Nginx, protecting web applications from a range of attacks while also allowing HTTP traffic monitoring, logging and real-time analysis through an event-based rule language.

This repository contains libmodsecurity, the ModSecurity v3 library. It acts as an interface to connectors that pass web traffic in, loads and interprets rules written in the SecRules format, and applies them to HTTP content from your application. Version 3 is a full rewrite that removes the Apache dependencies, aims for higher performance and a new architecture, and plans native JSON audit logs.

The older ModSecurity v2.x for Apache is still maintained in its own repository. The code is written in C++ and released under the Apache-2.0 license, under the OWASP organization. Rule sets such as the OWASP Core Rule Set are typically used alongside it.