One problem, one page
A site does not answer, a certificate is not issued, traffic does not go through: the Doctor checks everything end to end instead of leaving you to guess.
Доктор и безопасные обновления
One diagnostic, from the machine up to the origin of your sites, that says what is wrong and what to do, with your own values already filled in. And ToutWAF updates that verify the checksum, back up first and roll back by themselves if the new version does not start.
Where to find it in the console : Console: Infrastructure > ToutWAF Doctor; on the command line: toutwafctl doctor; updates: Administration > Updates.
What it is for
The cause and the action
Each finding gives its cause and what to do, with your own values (addresses, names, ports) already filled in.
The same check everywhere
The console, the REST API, the command line and the pre-check before every certificate order use the same check: they can never disagree.
A report to send
A plain text to copy or download for support. It contains the checks and the addresses of your installation, nothing about your visitors or the content of your pages.
What it checks
Each card is green, orange (to watch), red (to fix) or grey (not checked, with the reason).
ToutWAF
A data-plane node is enrolled and online; the policy is published and applied by the nodes; on the command line, the services are active.
This machine
The local ports (80, 443, 9443, 9444) listen, the machine's firewall lets the web ports in, and no firewalld rule is aimed at ToutWAF's address. Nothing is changed automatically.
DNS in IPv4 and IPv6
Every A and AAAA record of every site name leads to this ToutWAF. It finds the classic trap: an AAAA record left over at a CDN or proxy while the A record points here.
Certificate
The prerequisites of a certificate order (node, policy, port 80, DNS), then the state of the stored certificate: none, pending, last order failed with the authority's message, expired or expiring.
Reachable from the Internet
Optionally, the Let's Encrypt staging test server tries to reach port 80 of your site from outside; no certificate is kept.
Origin, scheduled tasks, anti-bot
The origin answers (connection refused, 5xx error, untrusted certificate, protected address), including after an address change; failing or missed scheduled tasks; programs (git, curl) challenged by mistake by the anti-bot.
Product updates from the console
The Updates page offers a new version as soon as it is published and can install it on the server it runs on.
- Two channels: stable (a version only when everything was tested) and development (beta, may contain bugs, not for production). No stable version is published yet.
- The checksum is verified, a backup of the configuration and the database is taken first, and if the new version does not start or fails its health check, the previous one is restored automatically.
- No silent downgrade: nothing is offered when the chosen channel is older than the installed version.
- When the console cannot apply the update, the page says why and shows the exact command to run as root.
Privacy of the Doctor
What it reads and what it sends.
- It reads nothing about visitors or the content of sites and sends nothing about them.
- Its probes to the DNS addresses of your site identify themselves as ToutWAF-Doctor/1.0: if your DNS points to the address of another company (a CDN), that company sees it.
- To find ToutWAF's public address it asks a third-party service at most once an hour; an environment variable and the “Public host name or IP” field in Settings avoid that.
What is not done, or not proven
We prefer to say it plainly.
- The Doctor says what to do but fixes nothing by itself: a firewall, a DNS or a router remains yours to set.
- The test from the Internet only works with a configured Let's Encrypt staging directory; without it, it is refused rather than issuing a real certificate.
- Part of the findings depends on what ToutWAF can see from the machine: a router, an Internet box or a cloud security group upstream is not inspected, the assistant only shows the settings to make there with your values.
- No stable ToutWAF version is published: console updates today concern the development version.
Use cases
A site that answers “421”
The Doctor says whether the site was just created, no node is enrolled, the publication failed or the typed name is wrong.
A certificate that is not issued
It spots the AAAA record left at a CDN before the order, so no attempts are wasted.
An update without stress
You read the release notes, update in one click, and the previous version comes back by itself if it fails.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
РедакцияБесплатно Входит во все предложения, включая оба бесплатных (Free и Free +)Pro и выше Платные предложения: видна в консоли, без лицензии заблокирована. Начиная с Pro, если не указано Agency или Enterprise
Ещё не проверено в реальных условиях Работает в тестах продукта, но ещё не проверялась с реальным сервисом, системой или оборудованием. Консоль показывает ту же пометку там, где вы настраиваете функцию.
- Одна диагностика от машины до источника: узел, политика, порты, брандмауэр, DNS, сертификат, доступ в Интернет, источникБесплатно
- Каждый вывод сопровождается причиной и действием простыми словамиБесплатно
- Проверка DNS для IPv4 и IPv6, распознающая адрес CDN или прокси, забытый в записи AAAAБесплатно
- Мастер запуска: узел, DNS, порты и сертификат в четырёх строках, сертификат заказывается только когда всё зелёноеБесплатно
- Необязательная проверка из Интернета через тестовый сервер центра сертификацииБесплатно
- Помощь с вашим маршрутизатором, домашним роутером, группой безопасности облака или брандмауэром с подставленными значениями (файлы для OPNsense и pfSense) Ещё не проверено в реальных условияхБесплатно
- Текстовый отчёт для поддержки: ничего о ваших посетителях и содержимом страницБесплатно
Вернуться к значению по умолчанию для расширенной опции можно всегда. Что происходит по окончании платной лицензии, описано в вопросах и ответах о тарифах: 48 часов льготного периода, 48 часов только для чтения, затем защита WAF отключается до продления.
Поставьте щит перед вашими приложениями уже сегодня
Установите его на собственный сервер или напишите нам, чтобы обсудить лицензии.