# How to block Tor exit node IP addresses

import DocButton from '~/components/webkit/DocButton.vue';
import Tabs from '~/components/tabs/Tabs'
import Code from '~/components/Code/Code.astro'


**Tor exit nodes** are the final point for the **Tor network** to connect with the internet. As Tor network traffic isn't encrypted anymore, data being accessed can become visible to the node and possibly result in security concerns or even malicious traffic.

Azion provides the **Azion IP Tor Exit Nodes** network list to all users registered with Azion. This list can be used to configure a behavior using Rules Engine to block all requests coming from IPs contained in the network list.

<DocButton href="/en/documentation/products/secure/edge-firewall/network-layer-protection/network-lists/" label="go to Network Lists reference" kind="secondary" size="medium" />

---

<Tabs client:visible>
    <Fragment slot="tab.console">Console</Fragment>
    <Fragment slot="tab.api">API</Fragment>

<Fragment slot="panel.console">
To create a rule:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Firewall**.
2. Select the firewall in which you want to configure the rule.
3. Click the **Rules Engine** tab.
4. Click the **+ Rule** button.
5. Give your rule a name and, optionally, a description.
6. In the **Criteria** section, select the `Network` variable.
7. As a comparison operator, select **matches**.
8. As an argument, select the `Azion IP Tor Exit Nodes` list.
9. In the **Behaviors** section, select **Drop (Close Without Response)** from the behavior list.
10. Click the **Save** button.

If your application receives a request generated from an IP that is in the list, the firewall will drop the request.
</Fragment>

<Fragment slot="panel.api">
1. Run the following `GET` request to retrieve the `id` of the **Azion IP Tor Exit Nodes** list:

<Code lang="bash" code={`
curl --request GET \
  --url https://api.azion.com/v4/workspace/network_lists \
  --header 'Accept: application/json' \
  --header 'Authorization: Token [TOKEN VALUE]
`} />

2. You'll receive a response similar to this:

<Code lang="json" code={`
{
  "count": 1,
  "total_pages": 1,
  "schema_version": 3,
  "links": {
    "previous": null,
    "next": null
  },
  "results": [
    {
      "id": 2,
      "last_editor": "user@email.com",
      "last_modified": "2023-11-14T21:35:39.808175Z",
      "list_type": "ip_cidr",
      "name": "Azion IP Tor Exit Nodes",
      "country_list": [],
      "ip_list": [
        "192.168.0.5"
      ]
    }
  ]
}
`} />


3. Run the following `POST` request in your terminal, replacing `[TOKEN VALUE]` with your [personal token](/en/documentation/products/guides/personal-tokens/), the `<edge_firewall_id>` variable with your [firewall ID](https://api.azion.com/#58376993-e0dd-4b51-9cd3-41d86122728f), and the `<network_list_id>` value with the IP Tor Exit Nodes list ID:

<Code lang="bash" code={`
curl --request POST \
  --url https://api.azion.com/v4/edge_firewall/firewalls/<edge_firewall_id>/request_rules \
  --header 'Accept: application/json' \
  --header 'Authorization: Token [TOKEN VALUE]' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "Block Tor Exit Nodes",
    "active": true,
    "criteria": [
      [
        {
          "conditional": "if",
          "variable": "\${network}",
          "operator": "is_in_list",
          "argument": <network_list_id>
        }
      ]
    ],
    "behaviors": [
      { "type": "drop" }
    ]
  }'
`} />

| Key | Description |
| --- | --- |
| `name` | Name of the rule |
| `behaviors` | Array that stores objects that define behaviors |
| `criteria` | Array that stores objects that define criteria |

See the [Azion API documentation](https://api.azion.com/#090fa5b0-3d68-4521-9a90-f4d93773f6d9) to find out more about criteria and behavior objects.

4. You'll receive the following response:

<Code lang="json" code={`
{
  "results": {
    "name": "Block Tor Exit Nodes",
    "is_active": true,
    "behaviors": [
      {
        "name": "drop"
      }
    ],
    "criteria": [
      [
        {
          "variable": "network",
          "operator": "is_in_list",
          "conditional": "if",
          "argument": "2"
        }
      ]
    ],
    "last_modified": "2023-12-12T21:36:20.114073Z",
    "last_editor": "user@email.com",
    "id": 29268,
    "order": 5
  },
  "schema_version": 3
}
`} />

5. Wait a few minutes for the changes to propagate.

If your application receives a request generated from an IP that is in the list, the firewall will drop the request.

:::tip
Check the [Azion API documentation](https://api.azion.com/) to know more about all features available via API.
:::
</Fragment>

</Tabs>

---