# yum install epel-release -y

# yum group install "Development Tools" -y　　　　# 安装基本编译工具

# cd /opt/

# wget http://luajit.org/download/LuaJIT-2.1.0-beta3.tar.gz

# tar -xvf LuaJIT-2.1.-beta3.tar.gz

# cd LuaJIT-2.1.-beta3/

# make && make install

# ln -sf luajit-2.1.-beta3 /usr/local/bin/luajit

# yum install gcc pcre pcre-devel zlib zlib-devel openssl openssl-devel -y

# cd /opt/

# wget https://openresty.org/download/openresty-1.13.6.1.tar.gz

# tar -xvf openresty-1.13.6.1.tar.gz

# cd openresty-1.13.6.1/

# ./configure --prefix=/usr/local/openresty --with-luajit --with-http_stub_status_module --with-pcre --with-pcre-jit

# gmake && gmake install
# ln -sf /usr/local/openresty/nginx/sbin/nginx /usr/local/openresty/bin/openresty

# /usr/local/openresty/bin/openresty   # 启动openresty

# netstat -lntp | grep 80              # 服务运行正常

tcp               0.0.0.0:              0.0.0.0:*               LISTEN 

# cd /usr/local/openresty/nginx/conf　　　　　　　　　　　　　　　　　　# 到openresty配置文件目录

# git clone https://github.com/loveshell/ngx_lua_waf.git　　　　　　# 下载

Cloning into 'ngx_lua_waf'...
# mv ngx_lua_waf/ waf/　　　　　　　　　　　　　　　　　　　　　　　　　　 # 改个简单的名字

# vim /usr/local/openresty/nginx/conf/nginx.conf

...
user nobody;     # 取消注释  
...
http{            # 在http块下添加如下内
...

lua_package_path "/usr/local/openresty/nginx/conf/waf/?.lua";
lua_shared_dict limit 10m;
init_by_lua_file  /usr/local/openresty/nginx/conf/waf/init.lua;
access_by_lua_file /usr/local/openresty/nginx/conf/waf/waf.lua;

...

# cd /usr/local/openresty/nginx/conf/waf/     # ngx_lua_waf目录

# vim config.lua

...

RulePath = "/usr/local/openresty/nginx/conf/waf/wafconf/"    # 规则文件路径

attacklog = "on"                                             # 启用日志

logdir = "/usr/local/openresty/nginx/logs/hack/"             # 日志目录

...

# mkdir -p /usr/local/openresty/nginx/logs/hack/

# chown -R nobody:nobody  /usr/local/openresty/nginx/logs/hack/

# /usr/local/openresty/bin/openresty               # 如果没有启动服务，则启动

# /usr/local/openresty/bin/openresty -s reload     # 如果已经启动，则重载配置

# /usr/local/openresty/bin/openresty -t            # 测试配置是否正常

nginx: the configuration file /usr/local/openresty/nginx/conf/nginx.conf syntax is ok

nginx: configuration file /usr/local/openresty/nginx/conf/nginx.conf test is successful

RulePath = "/usr/local/openresty/nginx/ngx_lua_waf/wafconf/"   ##指定相应位置

attacklog = "on"                            ##开启日志

logdir = "/usr/local/openresty/nginx/logs/hack/"           ##日志存放位置

UrlDeny="on"                              ##是否开启URL防护

Redirect="on"                             ##地址重定向

CookieMatch="on"                           ##cookie拦截

postMatch="on"                            ##post拦截

whiteModule="on"                           ##白名单

black_fileExt={"php","jsp"}

ipWhitelist={"127.0.0.1"}                    ##白名单IP

ipBlocklist={"1.0.0.1"}                     ##黑名单IP

CCDeny="on"                             ##开启CC防护

CCrate="100/60"                          ##60秒内允许同一个IP访问100次