Firewall

A firewall for web traffic is a checkpoint between the clients on the internet and an application. It reads each request before the application does: the address it comes from, the path it asks for, and the headers it sends. It compares what it reads with conditions you write, and a request that meets one receives the action attached to it, such as a refusal. Every other request reaches the application unchanged, so the application never handles the traffic the checkpoint refuses.

Firewall is the Platform Resource that runs that checkpoint on Azion’s distributed infrastructure, close to the client, in front of each workload that binds it. A firewall holds an ordered list of rules, and a request that a rule stops never reaches your application or its origin. Use Firewall to deny a path, block addresses or countries, rate-limit a client, refuse requests that carry an attack, or tell scripts from people.

Rule structure

A firewall acts through its rules. Each rule pairs criteria, which select requests, with behaviors, which act on the requests selected. This rule denies every request whose path starts with /deny-test, sent as the body of POST /v4/workspace/firewalls/<firewall-id>/request_rules:

• criteria holds blocks of conditions. The first criterion of a block opens with if, and each next one joins it with and or or. Here, ${request_uri} with starts_with matches /deny-test and every path that begins with it, such as /deny-test/page.
• behaviors lists what the rule does to a request it matches. deny answers 403 with Azion’s default error page, and no later rule runs for that request.
• name and active are the rule’s own fields. The API adds order, the rule’s position in the firewall’s list, in the order the rules are created.
• Azion Console builds the same rule in the firewall’s Rules Engine tab, from Request Uri, starts with, and Deny (403 Forbidden).

If you have written firewall rules as a condition and an action, the model transfers: criteria are the condition, and behaviors are the action.

Request path

Creating a firewall protects nothing. A firewall carries no domain of its own: it inspects the requests of each workload whose deployment names it, and no request until one does.

1. A workload answers on its domain, and its deployment names one firewall and one application. In Azion Console, the binding is the Firewall field of Deployment Settings. The API carries it as strategy.attributes.firewall, and azion create workload-deployment takes it as --firewall-id.
2. Each request to the workload reaches the firewall before the application.
3. The firewall compares the criteria of each rule with the request, in order. A rule whose criteria do not match runs nothing.
4. A rule whose criteria match runs its behaviors. A behavior that stops the request, such as a deny, answers the client, and no later rule runs.
5. A request that no rule stops reaches the application, which never sees a request that a rule stopped.

One firewall can serve the deployments of several workloads, and a change to its rules reaches every one of them. No propagation time is guaranteed. A new rule reaches traffic 6 min 29 s to 9 min 18 s after it is saved. A workload newly bound to a firewall can take several minutes to enforce its first rule. Until a change settles, answers alternate between the previous state and the new one, so send the request again until it answers as expected. For the rule order, what each behavior returns, and every propagation time, refer to How Firewall works.

Resources

A firewall can run three Products, and each one acts only on the requests that a rule hands it.

WAF

Web Application Firewall (WAF) is the web application firewall a firewall runs: at layer 7, the application layer, it scores each request that a Set WAF behavior hands it against eight threat families. Turn it on to refuse requests that carry threats of the OWASP Top 10 and others, such as SQL injection, cross-site scripting, and remote file inclusion. WAF is off in a new firewall, and you turn it on in Main Settings › Modules.

For how WAF scores a request and the fields that tune it, refer to Scoring and modes, Rule sets and Exceptions, and to refuse your first request with WAF, refer to the WAF quickstart.

Network Shield

Network Shield adds the Network criterion, ${network} in the API, which matches the client address of a request against a list of IP addresses and CIDR ranges, Autonomous System Numbers (ASNs), or countries. Use it to block known-bad addresses, restrict access by country, allow only your own networks, rate-limit a set of clients, or block Tor exit nodes. Network Shield is on in a new firewall.

For how a list matches a client address and the list types it takes, refer to List matching and Network Lists, and to deny your own address on one test path, refer to the Network Shield quickstart.

Bot Manager

Bot Manager scores each request that a firewall rule hands it for signs of automation, and runs the action you configure when the score reaches your threshold. Turn it on when automation such as credential stuffing, vulnerability scanning, inventory scraping, or checkout abuse reaches an application that also serves people. Bot Manager has no switch in Modules: it runs as a function instance that a Run Function behavior invokes, so the firewall needs its Functions switch on.

For how Bot Manager builds a score, its configuration, and the report log, refer to Bot scoring, Arguments, Logs, and Bot Manager Lite, and to score your first request, refer to the Bot Manager quickstart.

Scope and limits

• Built-in rules: with no Product turned on, a rule matches on Host, Request Uri, Scheme, Ssl Verification Status, and Client Certificate Validation. It can deny, drop, rate-limit, or answer the request with a custom response. For every criterion, operator, and behavior, refer to Rules Engine for Firewall.
• Responses: Deny (403 Forbidden) answers 403 with Azion’s default error page, and Drop (Close Without Response) sends no HTTP response. Set Rate Limit releases requests at its configured rate and answers 429 only to simultaneous requests beyond its burst, and a WAF block answers 400.
• Functions: a firewall runs JavaScript, your own protection logic included, through a function instance that a Run Function behavior invokes. The function declares the firewall execution environment, and it can deny, drop, or answer the request, or add request and response headers. You write it in Functions or install it from Azion Marketplace. Functions is on in a firewall created through the API, the CLI, or the Create Firewall page. For the event and its methods, refer to Functions for Firewall, and for working code, refer to Functions on a firewall.
• Marketplace: Radware Bot Manager and DataDome Bot Protection install from Azion Marketplace as firewall functions, under their own subscriptions.
• DDoS protection: DDoS Protection mitigates denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks in every account, with no configuration. The firewall’s DDoS Protection Unmetered switch carries the tag Automatically enabled in all accounts and cannot be turned off.
• Workloads: a workload’s deployment names one firewall, and one firewall can serve several workloads. A rule belongs to the firewall it was created on. Clone, a row action of the Firewalls list in Azion Console, starts a firewall as a copy of another, its function instances and rules included. For when to share one firewall, refer to Firewall best practices.
• Interfaces: you create and manage firewalls on the Firewalls page of Azion Console, and through the Azion API at /v4/workspace/firewalls. Azion CLI manages them with commands such as azion create firewall and azion create firewall-rule. azion.config.js declares a firewall and its rules for the Azion CLI to create, as Bind a rule set in azion.config.js shows. Installing a function from Azion Marketplace runs in Azion Console.
• Observability: no response header names the firewall or the rule that decided. Every response carries an x-azion-request-id header, which Azion’s default error page repeats. With the firewall’s Debug Rules setting on, Real-Time Events and Data Stream show the rules a request ran, in the $traceback field. The setting is off by default.
• Limits: a rule carries 1 to 5 blocks of 1 to 10 criteria each, and a function instance’s arguments hold up to 100,000 bytes. For every bound, the answer past it, and the bounds of WAF, Network Shield, and Bot Manager, refer to Firewall limits.
• Billing: Firewall is billed on requests and on rules. Each plan includes an amount of both, such as 10 rules per firewall on Hobby and 20 on Pro, and usage past it is billed. For the rates, refer to Pricing.
• Terms: the Firewall glossary defines the words the Firewall pages give a specific meaning, such as criterion, behavior, rule set, network list, and threshold.

Next steps