Stop the Noise: Build Your Own Smart App Firewall with Rust and Pingora
summary
Builds a custom WAF using Cloudflare’s Pingora and Rust and walks through the actual code: a tiny reverse proxy (~27 lines) that runs 45,000 requests per second on a small laptop, loads malicious IP lists and seclists into hash sets to instantly 404 probes, and adds a Pingora rate limiter to throttle abusers. Live metrics show 40–65% of requests stopped with minimal CPU cost and a working exportable metrics pipeline, proving a lightweight, reusable protector.
AI-written summary · about
chapters (16)
- 0:00Web app firewalls intro
- 1:47Why protect online services
- 6:03Build vs buy firewall
- 7:49Pingora and Rust
- 9:16Simple reverse proxy
- 13:11Proxy performance benchmarks
- 13:33IP-based restrictions
- 16:25Block malicious IPs
- 18:38Stop bots with empty UAs
- 19:19SecLists for attack paths
- 21:45Rate limiting with Pingora
- 23:31Smarter security logic
- 25:17Advanced Pingora features
- 26:45Real-world results
- 27:26Key takeaways
- 29:59Q&A: Risks and false positives
related talks
25mWTF, Rust for Web Development??
34mBe Fearless Using Rust in Production
15mHow I Used Rust to Become Extremely Offline
31mBuilding a Hypervisor Firewall with nftables and Rust- 31mBuilding a Hypervisor Firewall with nftables and Rust
52mEnable all your infrastructure’s power with Rust & Wasm
29mClosing the Supply Chain Security Loop with Rust & Pyrsia
26mJavaScript Won the Web, Rust Is Taking the Critical Path