Core Configuration Reference¶

Core configuration is file based. Most examples are key-value files with one setting per line.

server.conf¶

server.conf controls listeners, modules, logging, TLS, policy files, backend files, rate limit defaults, and protocol hardening.

Common keys¶

Key	Allowed values / syntax	Purpose
`http_enabled`	`true`, `false`	Enable HTTP listener.
`http_port`	Integer port	HTTP listener port.
`https_enabled`	`true`, `false`	Enable HTTPS listener.
`https_port`	Integer port	HTTPS listener port.
`http_redirect_to_https`	`true`, `false`	Redirect HTTP to HTTPS.
`http_redirect_status`	HTTP status, usually `301`, `302`, `307`, `308`	Redirect status code.
`frontend_tls_min_version`	`TLS1.2`, `TLS1.3`	Minimum frontend TLS version.
`tls_cert_file`	File path	Public certificate chain.
`tls_key_file`	File path	Private key path.
`waf_enabled`	`true`, `false`	Enable WAF module.
`rate_limit_enabled`	`true`, `false`	Enable rate limit module.
`traffic_log_enabled`	`true`, `false`	Enable traffic logs.
`trace_enabled`	`true`, `false`	Enable trace logs. Use carefully in production.
`modules_enabled`	Comma list such as `rate,geo,routes,waf,l4`	Enabled modules.
`modules_disabled`	Comma list	Modules to disable.
`global_default_action`	`ALLOW`, `BLOCK`	Final action when no rule allows traffic.
`waf_default_action`	`ALLOW`, `BLOCK`, `MONITOR`, `CHECK`	WAF default behavior.
`l4_acls`	File path	L4 ACL file.
`rate_limits_file`	File path	Rate limit rules file.
`geo_rules_file`	File path	GEO policy file.
`geo_db_path`	File path	Compatible country lookup database file. The database itself is customer-supplied and may require a third-party license.
`geo_ip_map_file`	File path	Optional manual CIDR-to-country map.
`routes_file`	File path	Route map file.
`waf_custom_rule_files`	File path or comma list	WAF DSL rules.
`backend_pool_file`	File path	Backend pool definitions.
`backend_health_file`	File path	Backend health state file.
`trusted_proxy_cidrs`	CIDR comma list	Proxies allowed to provide client identity headers.
`geo_trusted_proxy_cidrs`	CIDR comma list	Proxies allowed to provide GEO headers.
`sensitive_headers`	Comma list	Headers redacted from logs.
`sensitive_query_keys`	Comma list	Query keys redacted from logs.
`sensitive_body_keys`	Comma list	Body keys redacted from logs.
`max_body_bytes`	Bytes	Maximum request body size.
`body_prefix_cap`	Bytes	Body prefix retained for inspection/logging.
`headers_cap`	Integer	Maximum header count/cap.
`config_poll_ms`	Milliseconds	Config polling interval.

Example¶

http_enabled=true
http_port=8100
https_enabled=true
https_port=8443
http_redirect_to_https=true
frontend_tls_min_version=TLS1.2
tls_cert_file=/opt/vnetarmor/certs/fullchain.pem
tls_key_file=/opt/vnetarmor/certs/key.pem

modules_enabled=rate,geo,routes,waf,l4
global_default_action=BLOCK
waf_default_action=BLOCK

l4_acls=l4_rules.conf
rate_limits_file=rate_limits.conf
geo_rules_file=geo_rules.conf
routes_file=waf_routes.conf
waf_custom_rule_files=waf_rules.conf
backend_pool_file=backends.conf

Apply changes¶

Use reload for policy/config changes and restart for listener/TLS/binary changes.

vnetarmorctl --server manager01.example.local:9443 reload

See Sample Configs for sanitized examples derived from product configuration files.

GEO database note¶

GEO policy enforcement requires a country lookup source. VNetArmor does not bundle a commercial GEO database. Use a compatible customer-supplied database, trusted proxy metadata, or manual CIDR map according to your deployment design. See GEO Location Filtering and Database Licensing.