Firewall & Rate Limits
Firewall Policies (ACL)
Separate from Traffic Policy rules, the Firewall provides an access control list (ACL) system with condition-based matching. Configure in the dashboard under Firewall → Firewall Policy.
How Firewall Policies Work
Each policy evaluates incoming requests against a set of conditions. If all conditions match, the policy's action is applied:
- Allow — Permit the request through
- Block — Reject the request with a 403
Policies are evaluated in priority order. Each policy can be enabled/disabled independently.
Condition Types
| Type | Matches | Example |
|---|---|---|
| source_ip | Client IP address or CIDR | 192.168.1.0/24 |
| country | GeoIP country code | US, DE |
| path | Request URL path | /admin/* |
| method | HTTP method | POST |
| header | Request header value | X-Forwarded-For |
| cookie | Cookie value | session |
| browser | Browser name (from User-Agent) | Chrome |
| user_agent | Raw User-Agent string | Mozilla/5.0... |
| host | Request host/endpoint | api.example.com |
| protocol | Request protocol | HTTP/1.1 |
| port | Destination port | 8080 |
Operators
Each condition uses an operator to match values:
| Operator | Description |
|---|---|
| equals | Exact match |
| not_equals | Does not match |
| contains | Value contains substring |
| starts_with | Value starts with |
| ends_with | Value ends with |
| regex | Matches regex pattern |
| exists | Header/cookie exists (no value needed) |
| not_exists | Header/cookie does not exist |
Conditions can be combined with AND or OR logical operators.
AI-Generated Policies
Use the AI Magic Wand button when creating or editing a firewall policy to generate rules from a natural language description. For example: "Block all traffic from China targeting the /admin path, but allow my office IP 1.2.3.4".
Rate Limits
Separate from the Traffic Policy rate-limit rule, the Firewall Rate Limits page provides per-endpoint rate limiting with IP-specific rules. Configure in the dashboard under Firewall → Rate Limits.
Creating Rules
| Field | Description |
|---|---|
| Name | Descriptive rule name |
| Endpoint | Target endpoint |
| Source IPs | IP addresses or CIDR ranges (supports IPv4/IPv6). Tag-based input. |
| Requests per Window | Max requests allowed (1–1,000,000) |
| Window Size | 1 min, 5 min, 15 min, 1 hour, 6 hours, 12 hours, 1 day, 7 days, 30 days |
| Action | block or throttle |
| Priority | Evaluation order (0–999) |