Allow only the addresses in a list
Create a network list of allowed addresses and a firewall rule that denies every client outside it, in Azion Console, the Azion CLI, or the API.
You can let only the clients in a network list reach your application, from Azion Console, the Azion CLI, or the API. An ip_cidr list holds the addresses and ranges you allow. One firewall rule then denies every client whose address is not in it. Use this for what only known clients should reach, such as an internal tool or a test environment. To deny the clients in a list and let everyone else through, refer to Block requests by IP, ASN, or country.
Prerequisites
Console
- A workload bound to a firewall. The allowlist rule goes on that firewall.
- Network Shield on for that firewall. It starts on in every firewall and stays on until someone turns it off.
- The public IP address of each client that must keep access, your own included.
- An account that can sign in to Azion Console.
Create the list of allowed addresses
The allowlist is a list of the ip_cidr type, shown as IP/CIDR in Azion Console. Each of its items is one IPv4 or IPv6 address or range, such as 203.0.113.0/24 or 198.51.100.7. The rule compares the address of every client with these items and denies each address that matches none of them. For every field and type a list accepts, refer to Network list fields and List types.
Console
To create the allowlist in Azion Console:
Access Azion Console > Edge Libraries > Network Lists.
In the General section, enter a Name. For example: Allowed addresses.
In the Network List Settings section, select IP/CIDR. When the form opens, ASN is the selected type.
In the List field, enter one address or range per line. Write your public IP address in place of <your-ip>:
Select Save.
Azion Console confirms with the message Your network list has been created. In Network Lists, the List Type column of the list reads IP/CIDR.
In the Prepare regulated web applications for security audits use case, this section takes these values:
| Setting | Value |
|---|---|
| Team list | audit-team-addresses, of the IP/CIDR type, with 203.0.113.0/24 #security team office |
Create the rule that denies every other address
A Rules Engine for Firewall rule can deny a request, but it has no behavior that admits one. A request that no rule stops goes on to the application. The allowlist rule therefore denies, and its Network criterion uses the does not match operator. That criterion is true for every client outside the list. For a client in the list it is false, so the rule runs nothing and the firewall goes on to its next rule.
Console
To create the allowlist rule in Azion Console:
Access Azion Console > Secure > Firewalls, and select the firewall.
Azion Console opens the Create Rule drawer.
In the General section, enter a Name. For example: Allow only listed addresses.
In the Criteria section, select the Network variable and the does not match operator.
A variable that reads Network - required Network Shield means that Network Shield is off on this firewall. Turn it on in Main Settings > Modules and save the firewall, and the variable becomes selectable.
In the Select a Network dropdown, select Allowed addresses.
In the Behaviors section, select Deny (403 Forbidden).
Select Save.
Azion Console confirms with the message Rule successfully created. In the Rules Engine tab, the Status column of the rule reads Active.
In the Prepare regulated web applications for security audits use case, this section takes these values:
| Setting | Value |
|---|---|
| Country rule | audit - deny countries not served: Network does not match audit-served-countries, and Deny (403 Forbidden) |
| Operator in the API | does not match is is_not_in_list, with each list ID as a JSON integer |
Confirm that only listed clients reach the application
The only criterion of the allowlist rule is Network. It therefore acts on each request the firewall receives, whatever its path. A rule you add can take from 6 minutes 29 seconds to 9 minutes 18 seconds to reach traffic across Azion’s distributed infrastructure. Until then, the firewall answers each request as it did before. Send the request again until its answer changes.
With the rule in traffic, a client whose address is outside the list receives HTTP 403 and Azion’s default error page, headed Forbidden. A request from such a client returns this response:
The Your IP row holds the address that the firewall compared with the allowlist. If the rule denies a client that must pass, add the address from that row to the list. A change to the items of a list reaches traffic in 46 seconds to about 100 seconds, sooner than a rule you add. Until it settles, answers can switch between the old items and the updated ones. Repeat the request until the answers agree. For the response a denied client gets, refer to Deny (403 Forbidden).
A client in the list passes the allowlist rule, and the application decides what it receives. An application that serves no content answers 204:
Being in the allowlist does not exempt a client from the other rules of the firewall. When a blocklist rule also matches that client, the blocklist rule denies it, in either order. To apply the allowlist to one path only, add a Request Uri criterion, ${request_uri} in the API, to the same block. For that rule, refer to Guard one path with a network list.
In the Prepare regulated web applications for security audits use case, expect:
- The administration path answers only the team. From an address outside
203.0.113.0/24, a request to/adminreceives403. The same request from the team’s network reaches the application.