CasWAF vs BunkerWeb
BunkerWeb is a full-featured WAF and reverse proxy built on Nginx. It turns protections on by default, deploys with Docker and Kubernetes first, and carries a Pro edition and a hosted service on top of the open source one. CasWAF is the opposite bet: one Go program, the console inside it, settings in a database, Apache-2.0 all the way through, and nothing to upgrade to.
At a glance
| CasWAF | BunkerWeb | |
|---|---|---|
| License | Apache-2.0, no paid edition | AGPL-3.0, with Pro and a hosted Cloud |
| Built on | A single Go program; no Nginx underneath | Nginx |
| Deployment | One binary on Linux or Windows | Docker, Kubernetes, Swarm, Linux packages, Azure |
| Configured in | The console; settings in MySQL, shared by every node | Environment variables or the web UI |
| Protection by default | The rules you add; no rule set is bundled | ModSecurity with the OWASP Core Rule Set, bans, anti-bot, limits |
| Console login | Casdoor: MFA, LDAP, SAML and social logins | Local accounts |
| Editions | One, Apache-2.0 | Open source, Pro, and a managed cloud |
Where CasWAF is different
Apache-2.0 instead of AGPL-3.0
If you modify BunkerWeb and let other people use it over the network, the AGPL asks you to publish those changes. Apache-2.0 only asks for attribution, which matters when a gateway is part of something you ship.
No Nginx underneath
The gateway, the console and the rules are one Go program. There is no second web server to configure, patch or reason about, and the same binary runs on Windows.
Settings in a database
Sites, certificates and rules live in MySQL and every node reads the same rows, which makes several gateways behind one database the normal case rather than an integration.
Single sign-on is part of the console
Casdoor brings MFA, LDAP, SAML and social logins to the console, and the same login can be put in front of any site. BunkerWeb’s accounts are local to it.
Nothing held back
There is no Pro edition and no hosted service to move to, so every feature in the manual is in the program you download.
Where BunkerWeb is ahead
Protections are on when it starts
BunkerWeb ships the OWASP Core Rule Set, bans on bad behavior, anti-bot challenges and connection limits already wired up. CasWAF gives you the rule types and an empty rule list; you decide what to add.
Wider deployment story
Kubernetes, Docker Swarm, autoconf for containers, Azure and Linux packages are all first-class. CasWAF expects a binary and a database, and the cluster integrations are yours to build.
A plugin system
BunkerWeb extensions can add features without touching the core. CasWAF has no plugin API; what the gateway does is what the release does.
Reports in the UI
Its console is built around seeing what was blocked and why, which is further along than the records and dashboard in CasWAF today.
Which to pick
- You want broad protection switched on out of the box, on Kubernetes: BunkerWeb.
- You want one Apache-2.0 program with the console and SSO inside it: CasWAF.
- You manage sites on a few servers and want one database behind them: CasWAF.
- You need a vendor behind a self-hosted WAF: BunkerWeb Pro.
Related pages
Try CasWAF on one machine
Go, Node.js and MySQL, a Casdoor application for the console, and the gateway starts on port 17000.