How to instantiate functions in your firewall

1. Access Azion Console > select Firewall.
2. Click the firewall you want to configure.
3. In the Main Settings tab, enable the Functions module switch to enable functions.
4. Click the Save button.
5. Go to the Functions Instances tab.
6. Click + Function Instance.
7. Name your function instance. For example: Deny Geoip function.
8. On the Functions dropdown, select the function you want to use. In this example, Deny Geoip function.

• If you want, you can edit the Arguments.

9. Click the Save button.

The functions page now lists the newly created instance. However, this new function isn’t yet active in your application. You need to define what will trigger the function.

Still on the Firewall page:

1. Navigate to the Rules Engine tab.
2. Click the + Rule button.
3. Give a name to your rule.
4. Under the Criteria section, select the variable Network.
5. As a comparison operator, select matches.
6. As an argument, select the network list of the Countries type you want to use. For example: Blocked Countries Geoip.
7. In the Behaviors section, select Run Function from the behavior list.
8. Select the function you want to use. In this example, Deny Geoip function.
9. Click the Save button.

Once your application receives a request generated from one of the countries in the network list, the function in your firewall will deny the request based on the geo IP.

1. Run the following PATCH request in your terminal, replacing [TOKEN VALUE] with your personal token and the <edge_firewall_id> variable with your firewall ID to activate the Functions module:

curl --request PATCH --url https://api.azion.com/v4/edge_firewall/firewalls/<edge_firewall_id> --header 'Accept: application/json' --header 'Authorization: Token [TOKEN VALUE]' --header 'Content-Type: application/json' --data '{
  "modules": {
    "edge_functions": { "enabled": true },
  },
}'

2. You’ll receive a response with the updated value.
3. Run the following GET request to retrieve the edge_function_id of the Deny Geoip function function:

curl --request GET --url https://api.azion.com/v4/edge_functions/functions --header 'Accept: application/json' --header 'Authorization: Token [TOKEN VALUE]]'

4. You’ll receive a response similar to this:

{
"count": 1,
"total_pages": 1,
"schema_version": 3,
"links": {
  "previous": null,
  "next": null
},
"results": [
  {
    "id": 13426,
    "name": "Deny Geoip function",
    "language": "javascript",
    "code": "async function firewallHandler(event){
    // Access the country code through geoip
    let countryCode = event.request.metadata["geoip_country_code"]

    // Do some logic here
    // In this example, we are blocking access from Brazil
    if (countryCode === "BR"){
        event.deny();
    }

    // Then, if it comes from any other country,
    // the processing continues
    event.continue();
}

addEventListener("firewall", (event)=>event.waitUntil(firewallHandler(event)));",
    "json_args": {
      "value": "hello_world"
    },
    "function_to_run": "",
    "initiator_type": "edge_firewall",
    "active": true,
    "last_editor": "user@email.com",
    "modified": "2023-11-14T20:09:48.657555Z",
    "is_proprietary_code": false,
    "reference_count": 1
  }
]
}

5. Copy the <function_id> value.
6. Run the following POST request, replacing the <edge_firewall_id> variable with your firewall ID and the <function_id> value with the value you received in the previous response:

curl --request POST --url https://api.azion.com/v4/edge_firewall/firewalls/<edge_firewall_id>/functions --header 'Accept: application/json' --header 'Authorization: Token [TOKEN VALUE]' --header 'Content-Type: application/json' --data '{
"name": "Deny Geoip",
"args": {
},
"edge_function": <function_id>,
"active": true
}'

7. You’ll receive a response similar to this:

{
"results": {
  "name": "Deny Geoip",
  "json_args": {},
  "edge_function": <function_id>,
  "last_modified": "2023-11-22T18:50:11.812819Z",
  "last_editor": "your-email@example.com",
  "id": 2806
},
"schema_version": 3
}

8. Run the following GET to retrieve the id of the Blocked Countries Geoip network list:

curl --request GET --url https://api.azion.com/v4/workspace/network_lists --header 'Accept: application/json' --header 'Authorization: Token azion060b7df4369b5688b37b4645a3f5199db87'

9. You’ll receive a response similar to this:

{
"count": 2,
"total_pages": 1,
"schema_version": 3,
"links": {
  "previous": null,
  "next": null
},
"results": [
  {
    "id": 6217,
    "last_editor": "your-email@example.com",
    "last_modified": "2023-11-14T21:35:39.808175Z",
    "list_type": "countries",
    "name": "Deny Geoip",
    "country_list": [
      "Brazil"
    ],
    "ip_list": []
  }
]
}
}

10. Run the following POST request in your terminal, replacing [TOKEN VALUE] with your personal token, the <edge_firewall_id> variable with your firewall ID, the <edge_function_instance_id> value with the function instance ID, and the <<network_list_id>> value with the network list ID:

curl --request POST --url https://api.azion.com/v4/edge_firewall/firewalls/{edge_firewall_id}/request_rules --header 'Accept: application/json' --header 'Authorization: Token [TOKEN VALUE]' --header 'Content-Type: application/json' --data '{
  "name": "Create rule",
  "active": true,
  "criteria": [
    [
      {
        "conditional": "if",
        "variable": "${network}",
        "operator": "is_in_list",
        "argument": <network_list_id>
      }
    ]
  ],
  "behaviors": [
    {
      "type": "run_function",
      "attributes": {
        "function_instance_id": <edge_function_instance_id>
      }
    }
  ]
}'

11. Wait a few minutes for the changes to propagate.

Once your application receives a request generated from one of the countries in the network list, the function in your firewall will deny the request based on the geo IP.