RouteWarden builds lightweight, high-performance perimeter defense middleware for modern reverse proxies and container environments.
The goal is straightforward: intercept automated scanners, directory traversal, sensitive file probing, and path evasion attacks before requests reach your backend services.
A security middleware plugin for Traefik:
- Scanner and Probe Defense: Blocks automated scans looking for
.env, configuration backups, credentials, and exposed admin panels. - Anti-Evasion Engine: Normalizes complex path variations including multi-layer URL encoding (
%252e), semicolon matrix parameters (/;param/.env), backslashes, and null bytes. - IP & CIDR Allowlisting: Supports granular client IP filtering with
X-Forwarded-For,X-Real-IP, or socketRemoteAddr. - Flexible Responses: Return standard
404 Not Foundcloaking,403 Forbidden, custom JSON/HTML pages, Cloudflare Turnstile / hCaptcha challenges, silent TCP drops, or gzip bombs. - Pure Go: Built with standard library Go for seamless Yaegi runtime compatibility without external dependencies.
A native security module for the Caddy web server:
- Native Caddy Middleware: Plugs directly into the Caddy v2 HTTP pipeline and Caddyfile syntax.
- Shared Protection Engine: Uses RouteWarden's signature path normalization and zero-config sensitive path protection.
- Declarative Caddyfile Directives: Easy to configure alongside your existing proxy definitions.
- High Throughput: Minimal latency overhead, built to match Caddy's asynchronous architecture.
A zero-dependency Lua security module for NGINX & OpenResty:
- OpenResty & NGINX Lua: Runs in the
access_by_luaphase to block malicious requests before proxying. - Full Engine Parity: Complete feature parity with Go cores, including all 13 response modes, CIDR allowlists, query parameter inspection, and anti-evasion normalization.
- Hardware Acceleration: Automatically utilizes PCRE JIT (
ngx.re) when available with pure-Lua pattern matching fallback. - CrowdSec Integration: Emits single-line structured JSON security events for log acquisition and automated firewall remediation.
cli (rwarden)
The developer CLI and configuration tool for RouteWarden:
- Offline Path & Pattern Simulation: Test URLs, query params, and evasion vectors against RouteWarden's normalization engine without running a web server.
- Configuration Validator: Validate
routewarden.jsonagainst the official JSON schema before deploying. - Gateway Config Generator: Compile a unified
routewarden.jsonspecification directly into Traefik dynamic YAML, Docker Compose labels, Caddyfile directives, or OpenResty Lua tables. - Docker & Standalone: Pre-built binaries for macOS, Linux, and Windows, or runnable via
ghcr.io/routewarden/cli:latest.
| Resource | Description |
|---|---|
| CLI Documentation | RouteWarden developer CLI installation, testing commands, and configuration generation guides. |
| Interactive Playground | Test normalization rules, patterns, and response handling live in your browser. |
| Documentation | Full guides, configuration reference, and architecture details for Traefik, Caddy, and NGINX. |
| Getting Started | Quickstart setup with Docker Compose, Kubernetes, Caddyfile, and OpenResty. |
| Anti-Evasion Engine | How path normalization and traversal protection work under the hood. |
| Recipes & Examples | Setup examples for Immich, Zero-Trust Webhooks, Vaultwarden, and WordPress. |
traefik-warden: Traefik middleware plugin written in pure Go.caddy-warden: Caddy v2 HTTP middleware module.nginx-warden: NGINX & OpenResty Lua security module.cli: Unified CLI developer tool (rwarden) for rule testing and gateway config generation.
RouteWarden is open source and community-driven. We welcome contributions, bug reports, and suggestions.
- Read our Contributing Guide to get started.
- To report security issues, please review our Security Policy.
- Star and follow our repositories on GitHub for updates.