Securing Odoo with WAF BunkerWeb

Your ERP Data Is A Business Asset

Inside the ERP is stored almost all the contents of the company's "kitchen": customer data, selling prices, stock, financial reports, to employee salaries. If this system is breached or paralyzed, the impact is felt immediately: transactions stop, data leaks to competitors, and customer trust declines.

Once the ERP can be accessed from the internet (so the team can work from anywhere), the system is also visible to bots and hackers who search for vulnerabilities every day. Therefore, a secure ERP is not just about strong passwords, but also about a guard at the door

What Is WAF? Imagine a Security Guard at the Building Entrance

WAF (Web Application Firewall) works like a security guard at the office entrance. Every guest (request from the internet) is checked first: regular guests are allowed in, suspicious guests are turned away before they can reach the room. The room is your ERP Odoo.

BunkerWeb is one of the open source (free) WAFs that can be installed in front of Odoo. Here are the threats it guards against:

How WAF Works in Front of Odoo

All access from the internet goes through BunkerWeb. Odoo and the database are behind it and cannot be accessed directly.

Checklist for Business Owners

You do not need to install WAF yourself. Just ensure that the vendor or IT team can answer "yes" to the following questions:

• Is our ERP protected by WAF, not just a regular reverse proxy?
• Is the Odoo database management page closed from the internet?
• Are repeated login attempts automatically blocked?
• Does the admin account use a strong password and two-factor authentication (2FA)?
• Is the database automatically backed up every day and has its recovery been tested?
• Is Odoo and its modules regularly updated?
• Is there someone monitoring attack logs periodically?

If someone answered "no", that is a priority that needs to be discussed with your IT team or ERP vendor.

Section 2: For IT Team and IT Manager

The following section explains the installation of BunkerWeb in front of Odoo using Docker.

Step 1: Docker Compose

Components used:

This compose is intentionally minimal: only database connection. All site settings are done through the Web UI (Step 3), allowing the IT team to manage it without restarting the container.

services:
  bunkerweb:
    image: bunkerity/bunkerweb-all-in-one:1.6.17
    container_name: bunkerweb-aio
    depends_on: [bw-db]
    ports:
      - "80:8080/tcp"
      - "443:8443/tcp"
      - "443:8443/udp"
    environment:
      DATABASE_URI: "postgresql://bunkerweb:change-password-bw@bw-db:5432/db"
    volumes:
      - bw-storage:/data
    networks: [bw-services, bw-db]
    restart: unless-stopped

  bw-db:
    image: postgres:16
    environment:
      POSTGRES_USER: bunkerweb
      POSTGRES_PASSWORD: change-password-bw
      POSTGRES_DB: db
    volumes:
      - bw-db-data:/var/lib/postgresql/data
    networks: [bw-db]
    restart: unless-stopped

  odoo:
    image: odoo:19
    depends_on: [db]
    volumes:
      - odoo-data:/var/lib/odoo
      - ./config:/etc/odoo
      - ./addons:/mnt/extra-addons
    networks: [bw-services, odoo-db]
    restart: unless-stopped

  db:
    image: postgres:16
    environment:
      POSTGRES_USER: odoo
      POSTGRES_PASSWORD: change-strong-password
      POSTGRES_DB: postgres
    volumes:
      - odoo-db-data:/var/lib/postgresql/data
    networks: [odoo-db]
    restart: unless-stopped

volumes:
  bw-storage:
  bw-db-data:
  odoo-data:
  odoo-db-data:

networks:
  bw-services:
    name: bw-services
  bw-db:
    name: bw-db
  odoo-db:
    name: odoo-db

• Odoo does not open port to the host, so it cannot be accessed directly via IP:8069.
• The BunkerWeb database and the Odoo database are located in separate networks and are not open to the internet.

Step 2: odoo.conf

[options]
db_host = db
db_user = odoo
db_password = ganti-password-kuat
admin_passwd = master-password-yang-berbeda
proxy_mode = True
list_db = False
workers = 4
gevent_port = 8072

# Odoo can be accessed via HTTPS (result: 200)
curl -sI https://erp.example.co.id/web/login | head -n1

# Database Manager is blocked (result: 403)
curl -sI https://erp.example.co.id/web/database/manager | head -n1

# SQL injection pattern is blocked (result: 403)
curl -sI "https://erp.example.co.id/?id=1%27%20OR%20%271%27=%271" | head -n1

# Odoo port is not open (result: timeout / refused)
curl -m 5 -sI http://IP-SERVER:8069/web/login