RouteWardenHigh-Performance Edge & L4 Protocol Defense

What is RouteWarden? ​

RouteWarden is a unified edge defense suite built for reverse proxies and servers. It protects both web traffic (Layer 7) via Traefik, Caddy, and NGINX, as well as infrastructure services (Layer 4) via TCP Warden.

Every server exposed to the public internet gets hammered by automated scanning scripts hunting for .env files, .git trees, backup archives, open databases, and unauthenticated management ports. RouteWarden filters these threats out at the perimeter before they consume backend resources.

30-Second Setup ​

Get protected in seconds with your preferred gateway:

services:
  traefik:
    image: traefik:latest
    command:
      - "--experimental.plugins.routewarden.modulename=github.com/routewarden/traefik-warden"
      - "--experimental.plugins.routewarden.version=v1.4.2"
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.middlewares=warden@docker"
    ports:
      - "80:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      - "traefik.enable=true"
      # Global EntryPoint Shield: protects ALL services automatically
      - "traefik.http.middlewares.warden.plugin.routewarden.enabled=true"
      - "traefik.http.middlewares.warden.plugin.routewarden.enableDefaultPatterns=true"

  webapp:
    image: nginx:alpine
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=PathPrefix(`/`)"
      - "traefik.http.routers.app.entrypoints=web"

Request Inspection Lifecycle ​

RouteWarden evaluates inbound HTTP requests in five stages:

Default Protection Rules ​

With enableDefaultPatterns: true active, RouteWarden blocks common exposure paths without requiring custom rules:

Anti-Evasion Normalization ​

Attackers often obfuscate request paths to bypass string matching. RouteWarden normalizes paths before evaluation:

Response Actions ​

When a path matches a block rule, choose how RouteWarden defends your server:

• Clean Errors & Deception: Return custom json, html, text, xml, or a deceptive fakeSuccess (200 OK honeypot).
• Active Defense: Crash aggressive bots with gzipBomb (~1000× RAM expansion), reset connections via silentDrop, or delay scanners with tarpit.
• Challenges & Forwarding: Challenge suspicious traffic with captcha (Turnstile / hCaptcha / reCAPTCHA), rate-limit via rateLimitChallenge (HTTP 429), or divert to a canary backend via proxy.

Production Case Studies ​

Real-world deployment patterns demonstrating how engineering teams protect their applications using RouteWarden:

Ready to Explore? ​

• Protect non-HTTP infrastructure with TCP Warden (SSH, SMTP, databases, Redis).
• Deploy on Traefik Warden with Docker Compose templates.
• Deploy on Caddy Warden with native Caddyfile directives.
• Deploy on NGINX Warden with in-memory Lua inspection.
• Monitor live attacks with the RouteWarden CLI & Dashboard.
• Learn about the Core System Architecture and Anti-Evasion Engine.
• Browse real-world blueprints in the Cookbook & Case Studies.