# Firewall Plugin — Verified Architecture

## WAF Loop Test (2026-08-08)
- **WAF at 10.1.0.11:8081** forwards traffic correctly to return port
- **Plugin return listener on 10.1.0.10:8081** proxies to backends
- Verified with test-web.py: WAF → return port → Hello World response (200)
- Full chain: Zoraxy → Plugin → WAF → Return Listener → Backend works

## Known
- 502 from WAF when plugin return listener proxies real backend (52KB response)
- Short test-web.py response (small) works fine
- Wallarm configuration may need buffer/timeout adjustment