Run a function on a firewall

Create a function that runs on a firewall, instantiate it, and add the Rules Engine rule that triggers it.

Last updated

View as Markdown Agent setup

You can create a function, instantiate it on a firewall, and trigger it with a Rules Engine rule. Every step runs in Azion Console. To instantiate a function on a firewall from the Azion API, refer to Instantiate a function on a firewall. To run a function on an application instead, refer to Run a function on an application.

Prerequisites

  • An Azion account. To create one, refer to How to create an account on Azion.
  • The Edit Functions permission on the account. It grants permission to create, edit, and remove functions, and it also requires the permission View Functions.
  • The Edit Firewall permission on the account. It grants permission to view, create, edit, and remove a firewall, and it also requires the permission View Firewall. Refer to Teams Permissions.

Create the function

A function runs on a firewall when it exports a firewall handler. To create the function:

Open the Functions page

Access Azion Console > Products Menu > Libraries > Functions.

Select + Function
Name the function

Enter a name for the function. For example: deny-request.

Paste the code in the Code tab

In the Code tab, paste the following code:

JavaScript
01export default {
02 firewall: (request, env, ctx) => {
03 ctx.deny();
04 }
05};
Select Save

The function is saved and available to instantiate on a firewall.

The firewall handler decides the outcome of the request. ctx.deny() closes the request with an HTTP 403 Forbidden response. When the handler does not call ctx.deny(), the request continues to the fetch handler. For the other outcomes a firewall function returns, refer to Functions for Firewall.

The sample uses the ES Modules pattern. To move a function from the Service Worker pattern to this one, refer to Migrate handler patterns in Functions.

Create the firewall

A firewall runs a function only with the Functions module turned on. To create the firewall:

Open the Firewall page

In Azion Console, go to Products Menu > Firewall.

Select + Firewall
Name the firewall

Enter a name for the firewall. For example: deny-request firewall.

Select the domains the firewall secures

In the Domains field, select the domains to associate with the firewall.

Turn on the Functions module
Turn on the Active switch
Select Save

The firewall is saved, and the Functions Instances and Rules Engine tabs become available on the same page.

To use a firewall that already exists, open it and turn on the Functions module in the Main Settings tab.

Instantiate the function on the firewall

A function instance binds the function to one firewall. To create the instance:

Go to the Functions Instances tab

In the firewall you created, go to the Functions Instances tab.

Select + Function Instance
Name the instance

Enter a name for the instance. For example: deny-request instance.

Select the function

Select the deny-request function. Only functions whose Initiator Type is set to Firewall appear in the list.

Select Save

The instance appears in the Functions Instances tab. It does not run until a Rules Engine rule selects it.

Add the rule that runs the function

A Rules Engine rule sets the criteria that trigger the instance. To run the instance on requests whose URI starts with /admin:

Go to the Rules Engine tab

In the same firewall, go to the Rules Engine tab.

Select + Rule
Name the rule

Enter a name for the rule. For example: Run deny-request.

Select the variable in the Criteria section

In the Criteria section, select the Request URI variable.

Select starts with as the comparison operator
Enter the argument

Enter /admin as the argument.

In the Behaviors section, select Run Function
Select the instance you created
Select Save

The rule runs the instance on every request whose URI starts with /admin, and the function answers those requests with an HTTP 403 Forbidden response. Changes can take a few minutes to propagate. Wait before you send a request that matches the criteria.

Next steps

Instantiate a function on a firewallCreate the same instance from the Azion API, and pass Args to it in JSON.Functions for FirewallThe outcomes a firewall function returns, and the request and response headers it adds.Rules Engine for FirewallEvery criteria variable, comparison operator, and behavior a firewall rule accepts.Run a function on an applicationThe same path on an application, where the rule also sets the execution phase.