Network Shield quickstart

Create a network list with your own IP address, deny it on one test path with a firewall rule, and confirm that the request is refused.

Last updated

View as Markdown Agent setup

This guide instructs you through blocking your first request with a network list in Network Shield.

  • Create a network list that holds your own public IP address.
  • Deny that list on one test path with a firewall rule.
  • Send a request to the test path and read the refusal.

Four objects take part in the block, and each one links to the next:

  1. A network list holds the addresses to match. In this guide, it holds your own public IP address.
  2. A rule in the Rules Engine of a firewall matches that list with the Network criterion and denies the request. A second criterion limits the rule to the /network-shield-test path, so the rest of your application keeps answering you.
  3. The firewall carries the rule, and it must have Network Shield on. A firewall has Network Shield on by default.
  4. The workload that serves your application is bound to that firewall, so its requests pass through the rule.

A network list blocks nothing by itself. Until a rule on a firewall bound to a workload references it, the list matches no request.

Select an interface for this guide. The prerequisites and each stage switch to the interface you select.

Prerequisites

  • Azion CLI, installed and authorized. The commands in this guide match Azion CLI 4.23.0.
  • The ID of the firewall bound to your workload.
  • A personal token and curl. To create a token, refer to Personal Tokens.
  • The ID of the firewall bound to your workload.

Create a network list

A network list holds the entries that a rule matches, and its type fixes what kind of entry they are. The list in this stage has the ip_cidr type, IP/CIDR in Azion Console. It holds one item: your public IPv4 address with the /32 prefix, which covers that address alone. The type of a list never changes after creation.

To create the list in Azion Console:

Open the Network Lists page

Access Azion Console > Edge Libraries > Network Lists.

Start a list

Select Network List.

Name the list

In the General section, enter a Name. For example: network-shield-quickstart.

Select the IP/CIDR type

In the Network List Settings section, select IP/CIDR. The form opens with ASN selected.

Enter your address

In the List field, enter <your-ip>/32, with your public IPv4 address in place of <your-ip>.

Save the list

Select Save.

Azion Console shows the message Your network list has been created. The list appears in Network Lists, with IP/CIDR in the List Type column.

To create the list with Azion CLI:

Run the create command

Replace <your-ip> with your public IPv4 address:

azion create network-list --name "network-shield-quickstart" --type ip_cidr --items "<your-ip>/32"
Read the output

The command prints the ID of the list it created:

Created Network List with ID <network-list-id>

The list holds one item, your address. Record its ID, which you pass to the rule.

To create the list, send a POST request to /v4/workspace/network_lists:

Send the create request

Replace [TOKEN VALUE] with your personal token and <your-ip> with your public IPv4 address:

Shell
01curl -X POST https://api.azion.com/v4/workspace/network_lists \
02 -H "Authorization: Token [TOKEN VALUE]" \
03 -H "Accept: application/json" \
04 -H "Content-Type: application/json" \
05 -d '{"name":"network-shield-quickstart","type":"ip_cidr","items":["<your-ip>/32"]}'
Read the response

A create answers 201, and a state of executed means the API stored the list at once:

JSON
01{
02 "state": "executed",
03 "data": {
04 "id": <network-list-id>,
05 "name": "network-shield-quickstart",
06 "type": "ip_cidr",
07 "items": ["<your-ip>/32"],
08 "last_editor": "<your-email>",
09 "last_modified": "2026-01-01T12:00:00.000000Z",
10 "created_at": "2026-01-01T12:00:00.000000Z",
11 "active": true,
12 "version_id": null,
13 "version_state": null,
14 "is_versioned": false,
15 "version": null
16 }
17}

The list holds one item, your address. Record the value of data.id, which you pass to the rule as a number.

Deny the list on a test path

A rule in Rules Engine for Firewall runs its behavior only when its criteria are true. The rule in this stage joins two criteria with and in one block, so both must be true. The Network criterion matches the addresses in your list, and a Request Uri criterion matches paths that start with /network-shield-test. The Deny (403 Forbidden) behavior then refuses the request.

The test path is how this guide tests a block without refusing real traffic. The rule denies only requests from your address to /network-shield-test, and it lets every other request through.

To create the rule in Azion Console:

Open the firewall bound to your workload

Access Azion Console > Secure > Firewalls, and select the firewall.

Select the Rules Engine tab
Start a rule

Select Rule. The Create Rule drawer opens.

Name the rule

In the General section, enter a Name. For example: Deny my address on the test path.

Set the Network criterion

In the Criteria section, select the Network variable and the matches operator.

If the variable reads Network - required Network Shield, the firewall has Network Shield off. The variable becomes selectable after you turn Network Shield on in Main Settings and save.

Select your list

In the Select a Network dropdown, select the list you created. For example: network-shield-quickstart.

Add a second condition

To add a condition that must also be true, select And.

Scope the rule to the test path

In the added condition, select the Request Uri variable and the starts with operator, and enter /network-shield-test.

Add the Deny behavior

In the Behaviors section, select Deny (403 Forbidden).

Save the rule

Select Save.

Azion Console shows the message Rule successfully created. The rule appears in the Rules Engine tab, with Active in the Status column.

azion create firewall-rule takes only two flags, --firewall-id and --file, so the rule goes in a JSON file. To create it with Azion CLI:

Write the rule to a file

Save the following as rule.json. Replace <network-list-id> with the ID of your list, as a number without quotes:

JSON
01{
02 "name": "Deny my address on the test path",
03 "active": true,
04 "criteria": [
05 [
06 { "variable": "${network}", "conditional": "if", "operator": "is_in_list", "argument": <network-list-id> },
07 { "variable": "${request_uri}", "conditional": "and", "operator": "starts_with", "argument": "/network-shield-test" }
08 ]
09 ],
10 "behaviors": [
11 { "type": "deny" }
12 ]
13}
Create the rule

Replace <firewall-id> with the ID of your firewall:

azion create firewall-rule --firewall-id <firewall-id> --file rule.json
Read the output

The command prints the ID of the rule it created:

Created Firewall Rule with ID <rule-id>

The rule is active on the firewall. The last stage confirms that it denies your request.

To create the rule, send a POST request to /v4/workspace/firewalls/{firewall_id}/request_rules:

Send the create request

Replace [TOKEN VALUE] with your personal token and <firewall-id> with the ID of your firewall. Replace <network-list-id> with the ID of your list, as a number without quotes:

Shell
01curl -X POST https://api.azion.com/v4/workspace/firewalls/<firewall-id>/request_rules \
02 -H "Authorization: Token [TOKEN VALUE]" \
03 -H "Accept: application/json" \
04 -H "Content-Type: application/json" \
05 -d {
06 "name": "Deny my address on the test path",
07 "active": true,
08 "criteria": [
09 [
10 { "variable": "${network}", "conditional": "if", "operator": "is_in_list", "argument": <network-list-id> },
11 { "variable": "${request_uri}", "conditional": "and", "operator": "starts_with", "argument": "/network-shield-test" }
12 ]
13 ],
14 "behaviors": [
15 { "type": "deny" }
16 ]
17}
Read the response

A create answers 202 with the rule as stored. The order field is the position of the rule among the rules of the firewall, counted from 0:

JSON
01{
02 "state": "pending",
03 "data": {
04 "id": <rule-id>,
05 "name": "Deny my address on the test path",
06 "active": true,
07 "criteria": [
08 [
09 { "conditional": "if", "variable": "${network}", "operator": "is_in_list", "argument": <network-list-id> },
10 { "conditional": "and", "variable": "${request_uri}", "operator": "starts_with", "argument": "/network-shield-test" }
11 ]
12 ],
13 "behaviors": [{ "type": "deny" }],
14 "description": "",
15 "order": 0
16 }
17}

An argument sent as a string, such as "<network-list-id>" in quotes, is refused with 400 and 25042 Invalid Operator Argument Type. On a firewall with Network Shield off, the request is refused with 25047 Missing Required Modules.

Verify that the request is denied

The check is the same whichever interface created the rule. Your workload answers on its workload domain, which ends in .map.azionedge.net. The commands write it as <your-workload-domain>.

A rule you add needs several minutes to take effect across Azion’s distributed infrastructure. Until then, the test path answers as any other path does. Wait, then send the request again. For more information, refer to How Firewall works.

Send a request to the test path. The -4 flag sends it over IPv4, the address family of the item in your list:

curl -4 -i https://<your-workload-domain>/network-shield-test

The firewall denies the request:

Text
01HTTP/2 403
02server: nginx
03date: Thu, 01 Jan 2026 12:00:00 GMT
04content-type: text/html; charset=utf-8
05x-content-type-options: nosniff
06x-azion-request-id: <request-id>
07x-azion-edge-location: <edge-location>
08alt-svc: h3=":443"; ma=86400
09
10<title>Azion - Default error page</title>
11...
12<h1 class="error-header__title">Forbidden</h1>
13...
14Your IP <your-ip>
15Request ID <request-id>
16Status Code 403
17Edge Location <edge-location>

The body is Azion’s default error page, headed Forbidden. Its Your IP row shows the address that the firewall compared with the list, which is your own. No header names the firewall, the rule, or the list. The x-azion-request-id header identifies the request. To look up the request in the logs, refer to Real-Time Events.

Send the same request to another path of the workload:

curl -4 -i https://<your-workload-domain>/

The firewall lets the request through, and your application answers it:

Text
01HTTP/2 204
02server: nginx
03date: Thu, 01 Jan 2026 12:00:00 GMT
04x-azion-request-id: <request-id>
05x-azion-edge-location: <edge-location>
06alt-svc: h3=":443"; ma=86400

Your application decides that status. An application that serves no content answers 204. What matters is that the response is not the 403 error page.

Network Shield now denies your address on /network-shield-test, and every other path still answers you.

Next steps

List matchingWhat the Network criterion compares, what each behavior returns, and how long a change takes to reach traffic.Network ListsThe list types, item formats, annotations, and errors, before you build a list for real traffic.Block requests by IP, ASN, or countryBuild a list of addresses, networks, or countries for real traffic, and deny it in a firewall rule.Block Tor exit nodesBlock the addresses in the Tor exit node list that Azion maintains and refreshes.Allow only the addresses in a listSwitch the operator to does not match, so a rule denies every address outside the list.Firewall limitsThe bounds on a list and its items, and the Firewall usage each service plan includes.