Redis & Valkey Protocol Guard (redis)

The Redis Protocol Guard plugin implements an in-line command firewall for Redis Serialization Protocol (RESP2 and RESP3). It parses incoming client commands, blocks destructive administrative commands (FLUSHALL, CONFIG, SHUTDOWN, DEBUG) before they reach your cache, and monitors upstream responses for authentication failures (-WRONGPASS, -NOAUTH) to ban brute-force bots.

---

Capabilities & Threat Defense

Threat / Attack Vector	Defense Mechanism	Action Taken
Data Wipe & Sabotage	Blocks destructive commands (FLUSHALL, FLUSHDB)	Drops command and returns -ERR command blocked by RouteWarden
Remote Code Execution & Probing	Blocks configuration manipulation (CONFIG, DEBUG, MODULE)	Drops command with immediate synthetic error
Password Brute-Force	Tracks upstream -WRONGPASS and -NOAUTH replies	IP banned after max_auth_failures threshold
Connection Starvation	Token bucket rate limiting per IP	Excess connection attempts throttled

---

Installation

Install the plugin via CLI or declaratively:

# Install using short nametcp-warden plugins install redis# Or install via Git repository URLtcp-warden plugins install https://github.com/routewarden/plugins/redis

---

Configuration Reference

Add a Redis guard service to tcp-warden.yaml:

services:  redis_firewall:    listen: ":6379"    upstream: "127.0.0.1:63790"    protocol: "redis"    rate_limit:      connections_per_minute: 120      burst: 20    max_auth_failures: 5    ban_after_failures: 5    ban_duration: "1h"    plugin_config:      blocked_commands:        - "FLUSHALL"        - "FLUSHDB"        - "CONFIG"        - "SHUTDOWN"        - "DEBUG"        - "KEYS"        - "MODULE"        - "REPLICAOF"        - "SLAVEOF"

Configuration Options

Field	Type	Default	Description
listen	string	":6379"	Local proxy listen address and port.
upstream	string	"127.0.0.1:63790"	Target Redis, Valkey, or KeyDB server address and port.
protocol	string	"redis"	Must be set to "redis".
max_auth_failures	int	5	Failed AUTH attempts before IP is banned.
ban_duration	string	"1h"	Duration of the automated IP ban ("30m", "1h", "24h").
plugin_config.blocked_commands	[]string	["FLUSHALL", ...]	List of uppercase command names rejected by RouteWarden.

---

Network & Deployment Architecture

Because Redis operates on an unprivileged port (6379), kernel firewall redirects (nftables/iptables) are not required. Deploy RouteWarden using either direct reverse proxying or container network isolation:

Option A: Direct Port Swapping (Bare-Metal / VM)

Rebind Redis to loopback on an alternate port and expose RouteWarden on :6379:

# /etc/redis/redis.conf# Rebind Redis to loopback on an alternate portbind 127.0.0.1port 63790

Option B: Docker Compose Bridge Isolation

Publish port 6379 on RouteWarden while keeping Redis private to the internal container bridge network:

services:  routewarden:    image: ghcr.io/routewarden/tcp-warden:latest    ports:      - "6379:6379"      - "9091:9091"    volumes:      - ./tcp-warden.yaml:/etc/routewarden/tcp-warden.yaml:ro    depends_on:      - redis  redis:    image: redis:7-alpine    command: redis-server --requirepass supersecretpass    # Do NOT publish host ports; keep internal to bridge network

---

Testing & Verification

Verify cache operations, test blocked administrative commands, and trigger authentication failure bans:

# Verify legitimate cache commands succeedredis-cli -p 6379 SET test_key "hello"redis-cli -p 6379 GET test_key