Create Firewall Rules with Rules Engine

Integrate rules in your firewall to set tasks to be executed for specific scenarios without changing your existing code.

View as Markdown

Use Rules Engine to define the conditions and behaviors your Firewall executes for each incoming request.

This guide walks you through creating a rule using a practical example: verifying whether a client certificate exists and returning a custom response when it doesn’t. This is useful for enforcing mTLS policies, such as those required for BACEN compliance.

There are different criteria that require different Firewall modules. Make sure you have the right module activated to create your rules.

To create a rule:

  1. Access Azion Console > Firewall.
  2. Select the firewall in which you want to configure the rule.
  3. Click the Rules Engine tab.
  4. Click the + Rule button.
  5. Give your rule a name and, optionally, a description.
  6. In the Criteria section, select the SSL Verification Status variable.
  7. As a comparison operator, select is equal.
  8. As an argument, select Missing Client Certificate.
  9. In the Behaviors section, select Set Custom Response.
  10. As arguments:
    • On Status Code, add 401.
    • On Content Type, define the MIME type of the response body. Example: application/json.
    • On Content Body, pass the message you want to present to users.
  11. Click the Save button.

If you need to forward the authenticated client’s identity to your origin server using mTLS — for example, passing the client certificate Common Name (CN) via the client_cn header — use Rules Engine for Applications with the ${ssl_client_s_dn_parsed} variable and the Add Request Header behavior. See Specifying mTLS variables in HTTP headers for a complete guide.