ocpipi.rhosovst.redhat.local DetectionOnly
Network Architecture • ocpipi.rhosovst.redhat.local

WAF traffic flow, end to end

How a request travels from client to app pod through the NGINX + ModSecurity WAF, F5 Big-IP L4 passthrough, and OpenShift routers — and where each TLS leg terminates. Click any node for detail, or isolate a single flow below.

TLS Leg 1
TLS Leg 2
F5 L4
DNS
API :6443
Audit Log
TLS cert location
Network Architecture — WAF + F5 + OpenShift
External
WAF Node — RHEL 9
F5 Big-IP
OpenShift Cluster
💻

Client / Browser

End user • oc CLI

no cert
🌐

Corporate DNS

*.apps resolution

🛡

NGINX + ModSecurity v3

OWASP CRS • 850 rules
TLS terminate & re-encrypt

172.16.28.40:443
🔒 wildcard.crt/key
/opt/waf/certs/ → /etc/nginx/certs/
📄

Audit Log (JSON)

modsec_audit.log
RelevantOnly • logrotate 14d

⚖

F5 VIP — App

Layer 4 Passthrough
TCP forward only

172.16.46.8:443
no TLS termination
⚖

F5 VIP — API

Layer 4 Passthrough
Control-plane traffic

172.16.46.7:6443
no TLS termination
🔃

Router Pod 1

haproxy

172.16.46.36
🔒 router-certs-default
🔃

Router Pod 2

haproxy

172.16.46.27
🔒 router-certs-default
📦

App Pods

console • oauth
monitoring • downloads

🔒 per-route certs
🖥

Master Nodes

kube-apiserver • 3x control plane

master-0 • master-1 • master-2
🔒 api-server cert
DNS query → resolves to WAF IP HTTPS :443 TLS Leg 1 — *.apps wildcard cert terminates here HTTPS :443 TLS Leg 2 — re-encrypted, SNI=$host L4 TCP L4 passthrough TCP only — TLS passes through intact api.ocpipi:6443 — DIRECT bypasses WAF (still routed via F5) audit
WAF 172.16.28.40
F5 VIP 172.16.46.8
Routers .36 / .27
API 172.16.46.7
Engine: DetectionOnly
CRS: 850 rules