Create IP, ASN & Geo Blocklists

Manage lists of IPs, ASNs, and geolocations from accessing your applications at the edge with Network Lists.

View as Markdown

Network Shield allows the creation of Network Lists, to allow (allowlists) or disallow (blocklists) visitors from interacting with applications at Azion.

Network Lists can be based on user’s IP addresses, ASN, and geolocation addresses. They can be custom-made, considering the application scope and actual requests, or pre-made and maintained by Azion, such as the Azion IP Tor Exit Nodes Network List.

go to Network Lists reference

go to Network Shield reference

There are separate instructions using legacy Domains settings using the new Workloads product.

If you’re not sure which steps apply to your account, see the Verify Your Account Migration guide to determine if your account has already been migrated.

To create, manage, and use Network Lists, you must to complete the following steps:

  1. Create a firewall with the Network Shield module activated.
  2. Create a Network List.
  3. Associate this Network List within the Firewall Rules Engine tab.

Creating a firewall

To create a new firewall with the Network Shield module activated:

  1. Access Azion Console > Firewall.
  2. Click the + Firewall button.
  3. Write the firewall identification name on the Name placeholder.
  4. Make sure the Network Shield switch is enabled at the Modules section.
  5. In Status, make sure the Active switch is enabled.
  6. Click the Save button.

To bind the Firewall to a Workload, follow these steps: To bind the Firewall to a Workload:

  1. Still in the Console, go to Products Menu > Workloads
  2. Under Settings select the firewall you created.
  3. Click the Save button.

You can see the created firewall from the list.

Activating the Network Shield module

For already created firewalls, follow the steps:

  1. Access Azion Console > Firewall.
  2. From the firewalls list, select the firewall you wish to add a Network List.
  3. In the Main Settings tab, enable the Network Shield switch.
  4. Click the Save button.

Creating a Network List

  1. Access Azion Console > Network Lists, from the Edge Libraries section.
  • When opening the Network Lists page, all lists created by the user and those items automatically provided by Azion will be displayed.
  1. Click the + Network List button.
  2. Fill in the following fields:
FieldDescription
NameIdentification name of your Network List. This name will appear in the list of options in the Criteria section, within the Firewall Rules Engine configuration
TypeType of the network list:
Autonomous System Number (ASN)
Countries
IP/CIDR
ListAdd the items that will make up your list here
  • For ASN and IP/CIDR list types, a typing field will be displayed. List items must be separated by line and you must write one address per line. Duplicated items will be deleted.
  • For the Countries type, a selection list will be presented.
  1. Click the Save button.

IP/CIDR type list example:

123.456.789.1
123.456.789.2/32
10.1.1.0/16

Associating a Network List with Firewall Rule Set

  1. Access Azion Console > Firewall.
  2. Select the firewall you created on the first section.
  3. Select the Rules Engine tab.
  4. Click the + Rule button.
  5. Write the name and description for the rule set.
  6. On the Criteria section, choose the logical operator, variable, comparison operator, and network list name on the dropdown menus to follow this logic:
[If]: [Network] [matches] [Network List identification name]
  1. On the Behavior section, select Drop (Close Without Response).
  2. Make sure the Active switch is enabled.
  3. Click the Save button.

In this example, if the conditions set by the rules are met, a drop will be run for the request without sending any return to the sender.