Block addresses until a date
Deny an address until a due date with a dated network list entry and a firewall rule, then end the block with a write of the list.
You can block an address until a date of your choice from Azion Console, the Azion CLI, or the API. For example, an address that abused a login form can stay blocked for one day. The entry for that address in an ip_cidr network list carries the due date. One firewall rule denies every address in the list. The date alone never lifts the block: the address stays denied until a write of the list’s items drops its entry. To block an address with no end date, refer to Block requests by IP, ASN, or country.
Prerequisites
Console
- A workload bound to a firewall. The rule that denies the list goes on that firewall.
- Network Shield on for that firewall. It starts on in every firewall and stays on until someone turns it off.
- An account that can sign in to Azion Console.
Create a list with a dated entry
Only a list of the ip_cidr type, shown as IP/CIDR in Azion Console, accepts annotations on its items. An annotated item is refused with 22011 in an asn list and with 22015 in a countries list. A due date follows the address after a space. It is --LT in uppercase, then a UTC date and time in whole seconds that ends in Z, such as --LT2030-01-01T00:00:00Z. A comment starts with # and goes last on the line, after any due date. A line that starts with # is not a comment, and the API refuses it with 22005.
The list in this guide holds two items. 198.51.100.7 carries a due date and the comment #login abuse, while 192.0.2.10 carries neither. The undated item keeps the list writable after the date passes. A write in which every item is past due is refused with 22019 All Network Items Are Expired. For the annotation grammar, refer to Item annotations. For the fields of a list and its three types, refer to Network list fields and List types.
Console
To create the list with the dated entry in Azion Console:
Access Azion Console > Edge Libraries > Network Lists.
In the General section, enter a Name. For example: Blocked addresses.
In the Network List Settings section, select IP/CIDR. When the form opens, ASN is the selected type.
In the List field, enter each entry on its own line. The first one carries a due date and a comment, and the second carries neither:
Write the UTC date and time when the block should end in place of 2030-01-01T00:00:00Z. A date that is not in the future is flagged with the --LT date must be in the future.
Select Save.
Azion Console confirms with the message Your network list has been created. In Network Lists, the List Type column of the list reads IP/CIDR.
In the Block attackers automatically from SIEM detections use case, this section takes these values:
| Setting | Value |
|---|---|
| Network list | siem-blocklist, of the IP/CIDR type, the only type that accepts a due date on its entries |
| First entry | 192.0.2.10 #permanent block, with no due date |
In the Screen file uploads for malicious content use case, this section takes these values:
| Setting | Value |
|---|---|
| Network list | upload-senders, of the IP/CIDR type |
| First entry | 198.51.100.42 --LT2030-01-01T00:00:00Z #<request-id>, with the date 7 days after the upload in place of 2030-01-01T00:00:00Z |
Create the rule that denies the listed addresses
The rule reads the list through the Network criterion with its matches operator. Its Deny (403 Forbidden) behavior refuses each client that matches. It denies both addresses for as long as their items stay stored in the list. A due date that passes does not change what the rule matches. For every criterion and behavior a rule takes, refer to Rules Engine for Firewall.
Console
To create the deny rule in Azion Console:
Access Azion Console > Secure > Firewalls, and select the firewall.
Azion Console opens the Create Rule drawer.
In the General section, enter a Name. For example: Deny listed addresses.
In the Criteria section, select the Network variable and the matches operator.
A variable that reads Network - required Network Shield means that Network Shield is off on this firewall. Turn it on in Main Settings > Modules and save the firewall, and the variable becomes selectable.
In the Select a Network dropdown, select Blocked addresses.
In the Behaviors section, select Deny (403 Forbidden).
Select Save.
Azion Console confirms with the message Rule successfully created.
With the rule in traffic, a request from either address receives 403. A rule you add can take from 6 minutes 29 seconds to 9 minutes 18 seconds to get there across Azion’s distributed infrastructure. Send a request from a listed address again until it answers 403.
In the Block attackers automatically from SIEM detections use case, this section takes these values:
| Setting | Value |
|---|---|
| Rule | siem - deny listed addresses |
| Criterion | Network matches siem-blocklist, which the API sends as ${network} is_in_list with the list ID as a JSON integer |
| Behavior | Deny (403 Forbidden) |
Every address in siem-blocklist receives 403 once the rule propagates, 6 to 10 minutes after it is saved. To protect several applications, add the same rule to each of their firewalls: every rule reads the one list, so one write blocks the address everywhere.
In the Screen file uploads for malicious content use case, this section takes these values:
| Setting | Value |
|---|---|
| Rule | upload - deny flagged senders |
| Criterion | Network matches upload-senders |
| Behavior | Deny (403 Forbidden) |
A listed sender receives 403 on every route of the workload. A later change to the items reaches traffic in about 100 seconds, with no change to the rule.
Remove the entry after its due date
Azion reads a due date only when the items of a list are written, and each write drops the items already past due. An item whose date passes after the write stays stored and keeps matching. Giving the list another name does not remove the item either.
A write of the list’s items is what ends the block. Send it from the interface you use, or from a job of your own. That job can be a scheduled script, or the security information and event management (SIEM) system that flagged the address. Sent after each due date, the write drops every item past due by then.
Console
To remove the dated entry in Azion Console:
Access Azion Console > Edge Libraries > Network Lists, and select Blocked addresses.
In the List field, delete the line for 198.51.100.7. Once its date has passed, the form flags that line with the --LT date must be in the future.
Select Save.
Azion Console confirms with the message Your Network List has been updated., and the list holds 192.0.2.10 alone.
Once the write reaches traffic, the rule no longer denies 198.51.100.7. A change to the items of a list takes 46 seconds to about 100 seconds to get there, less than a rule you add. Until it settles, answers can switch between the old items and the updated ones. Repeat a request from that address until the answers agree. To try a list and a rule against your own address first, refer to Network Shield quickstart.