# Create IP, ASN & Geo Blocklists

import DocButton from '~/components/webkit/DocButton.vue';
import Tabs from '~/components/tabs/Tabs'


**Network Shield** allows the creation of **Network Lists**, to allow (*allowlists*) or disallow (*blocklists*) visitors from interacting with applications at Azion. 

Network Lists can be based on user's IP addresses, ASN, and geolocation addresses. They can be custom-made, considering the application scope and actual requests, or pre-made and maintained by Azion, such as the *Azion IP Tor Exit Nodes Network List*.

<DocButton href="/en/documentation/products/secure/edge-firewall/network-layer-protection/network-lists/" label="go to Network Lists reference" kind="secondary" size="medium" />
<br/>
<DocButton href="/en/documentation/products/secure/firewall/network-shield/" label="go to Network Shield reference" kind="secondary" size="medium" />

There are separate instructions using [legacy Domains](/en/documentation/products/build/applications/domains/) settings using the new [Workloads](/en/documentation/products/secure/workloads) product.

:::tip
If you're not sure which steps apply to your account, see [the Verify Your Account Migration guide](/en/documentation/products/guides/verify-account-migration/) to determine if your account has already been migrated.
:::
---

To create, manage, and use Network Lists, you must to complete the following steps:

1. Create a firewall with the **Network Shield** module activated.
2. Create a **Network List**.
3. Associate this Network List within the Firewall Rules Engine tab.

## Creating a firewall

To create a new firewall with the **Network Shield** module activated:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Firewall**.
2. Click the **+ Firewall** button.
3. Write the firewall identification name on the **Name** placeholder.
4. Make sure the **Network Shield** switch is enabled at the **Modules** section.
5. In **Status**, make sure the **Active** switch is enabled.
6. Click the **Save** button.

<Tabs client:visible>
    <Fragment slot="tab.consoleworkloads">Console - Workloads</Fragment>
    <Fragment slot="tab.consoledomains">Console - Domains</Fragment>

<Fragment slot="panel.consoleworkloads">
To bind the Firewall to a Workload, follow these steps:
To bind the Firewall to a Workload:

1. Still in the Console, go to **Products Menu** > **Workloads**
2. Under **Settings** select the firewall you created.
3. Click the **Save** button.

</Fragment>

<Fragment slot="panel.consoledomains">
To bind the Firewall to a Domain, follow these steps:
To bind the Firewall to a Domain:

1. Still in the Console, go to **Products Menu** > **Domains**
2. Under **Settings** select the firewall you created.
3. Click the **Save** button.

</Fragment>
</Tabs>

You can see the created firewall from the list.

### Activating the Network Shield module

For already created firewalls, follow the steps:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Firewall**.
2. From the firewalls list, select the firewall you wish to add a Network List.
3. In the **Main Settings** tab, enable the **Network Shield** switch.
4. Click the **Save** button.

---

## Creating a Network List

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Network Lists**, from the **Edge Libraries** section.
- When opening the **Network Lists** page, all lists created by the user and those items automatically provided by Azion will be displayed.
2. Click the **+ Network List** button.
3. Fill in the following fields:

| Field              | Description                                                                                                                                                                |
|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `Name`             | Identification name of your Network List. This name will appear in the list of options in the *Criteria* section, within the **Firewall Rules Engine** configuration  |
| `Type`             | Type of the network list: <br /> `Autonomous System Number (ASN)` <br /> `Countries` <br /> `IP/CIDR`                                                                      |
| `List`             | Add the items that will make up your list here                                                                                                                             |

- For `ASN` and `IP/CIDR` list types, a typing field will be displayed. List items must be separated by line and you must write one address per line. Duplicated items will be deleted.
- For the `Countries` type, a selection list will be presented.

4. Click the **Save** button.

IP/CIDR type list example:

```
123.456.789.1
123.456.789.2/32
10.1.1.0/16
```

---

## Associating a Network List with Firewall Rule Set

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Firewall**.
2. Select the firewall you created on the [first section](#creating-an-edge-firewall).
3. Select the **Rules Engine** tab.
4. Click the **+ Rule** button.
5. Write the name and description for the rule set.
6. On the **Criteria** section, choose the *logical operator*, *variable*, *comparison operator*, and *network list name* on the dropdown menus to follow this logic:

```
[If]: [Network] [matches] [Network List identification name]
```

7. On the **Behavior** section, select `Drop (Close Without Response)`.
8. Make sure the **Active** switch is enabled.
9. Click the **Save** button.

In this example, if the conditions set by the rules are met, a *drop* will be run for the request without sending any return to the sender.