# Firewall import DocButton from '~/components/webkit/DocButton.vue'; **Firewall** is a resource in the Azion platform that protects workloads running on its globally distributed infrastructure by inspecting and filtering traffic close to the requester—before it reaches the application. Its composable architecture allows you to combine powerful modules—**DDoS Protection**, **Web Application Firewall**, **Network Shield**, **Bot Manager**, and **Functions**—to address specific aspects of traffic inspection and threat mitigation. These capabilities can be used to build a comprehensive security policy that matches your workload’s requirements, while leveraging the platform’s global reach and low-latency performance. Advantages of using Firewall: - Low-latency access, requests and responses. - Prevention of cybercriminals from reaching your origin/server by processing and blocking unwanted requests on the Azion Global Infrastructure. - Highly programmable, modular, and extendible. - Creation of allowed rules, blocklists, and greylists based on IP/CIDR address, ASN, or user location. - Protection of applications from the Tor network and other malicious traffic sources, including botnets, malware, proxies, and others. - Access rate limitation to applications using complex criteria and multiple buckets. - Mitigation of Denial of Service (DoS and DDoS) attacks. - Protection against OWASP Top 10 threats and others. - Implementation of bot mitigation techniques, including blocklists, fingerprints, tampering protection, brute force prevention, advanced rate limiting, human challenge, and others. - Integration of Azion curated functions or third-party software in Firewall for extended functionalities, such as IP reputation, fingerprint, JSON Web Tokens (JWT), credential stuffing, account takeover, price scraping, contact scraping, and others. For more details on the product's accounting, see the [pricing](/en/documentation/products/pricing/) page. ## Implementation | Scope | Source | | ----- | ------ | | Main settings | [How to configure main settings](/en/documentation/products/guides/secure/firewall-configure-main-settings/) | | Update Firewall | [How to update your Firewall](/en/documentation/products/guides/how-to-update-your-firewall/) | | Get to know Network Lists | [Network Lists](/en/documentation/products/secure/edge-firewall/network-layer-protection/network-lists/) | | Get to know WAF Rule Sets | [WAF Rule Sets](/en/documentation/products/secure/firewall/web-application-firewall/rules-set/) | | Get to know WAF Custom Allowed Rules | [WAF Custom Allowed Rules](/en/documentation/products/secure/firewall/web-application-firewall/custom-allowed-rules/) | | Get to know Functions | [Functions Instances for Firewall](/en/documentation/products/secure/firewall/functions-instances/) | | Get to know Rules Engine | [Rules Engine for Firewall](/en/documentation/products/secure/firewall/rules-engine/) | | Get to know Certificate Manager | [Certificate Manager for Secure](/en/documentation/products/secure/firewall/certificate-manager/) | | DNSSEC Compatibility | [DNSSEC Compatibility](/en/documentation/products/secure/edge-dns/dnssec-compatibility/) | | Create network lists | [How to create IP blocklists with Network Shield](/en/documentation/products/guides/blocklists-ip-addresses-edge/) | | WAF Mode | [How to check your WAF mode](/en/documentation/products/guides/how-to-check-your-waf-mode/) | ## How Azion Firewall works By using Azion as your web development platform, you can create security settings on Firewall to protect your applications. Those firewall settings represent a set of rules that will be applied to the domains of your applications. :::tip You can share the same firewall among all applications that adopt the same security policy. ::: An firewall consists in an identification name, all your application domains where Firewall should be applied, what are the applied modules, and what are the security rules configured in the **Rules Engine** tab. :::note You need to activate at least one of the following modules for the firewall to work: **Functions**, **Web Application Firewall**, or **Network Shield**. ::: ### Rules Engine for Firewall After activating the modules you want, you must configure your security rules in the **Rules Engine** tab. The rules you configure will run sequentially until the request is blocked or restricted or until all your rules are processed, at which point the request is released. The request's data stream only passes onto your application if none of your Firewall rules block or reject the request, ensuring that malicious requests don't reach your application. Each rule is made of *Criteria* (conditionals) and *Behaviors* (commands). The *Behaviors* setup will run if the conditions are met. For example, you can set up rules to block requests that come from IPs that are in a *blocklist* or even make up rules to exclude IPs that are in the allowed rules list. In this example, “block” is the Behavior, while the IP of the request is in the *blocklist* and not present in the *allowed rules* is the condition (Criteria). The Criteria and Behaviors available in Firewall depend on the modules you have enabled in the firewall main configuration. Here's the list of Criteria and Behaviors available to each Firewall module: List of Criteria and Behaviors available to each Firewall module: | Module | Criteria | Behavior | |--------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------| | Built-in (always on) | `Hostname`
`Request URI`
`Scheme`
`Client Certificate Validation`
`Ssl Verification Status` | `Deny (403 Forbidden)`
`Drop (Close Without Response)`
`Set Rate Limit` | | Functions | - | `Run Function` | | Network Shield | `Network` | - | | Web Application Firewall | `Header Accept`
`Header Accept-Encoding`
`Header Accept-Language`
`Header Cookie`
`Header Origin`
`Header Referer`
`Header User Agent`
`Request Args`
`Request Method` | `Set WAF Rule Set` | :::note The DDoS Protection module is activated by default and doesn't need any additional configuration. ::: ## About Firewall modules ### DDoS Protection The **DDoS Protection** module protects your content and applications against *Distributed Denial of Service (DDoS)* attacks, as it detects attacks using advanced algorithms that run on Azion's distributed network. This distributed network is connected to several mitigation centers to guarantee mitigation during large-scale attacks, both at the network and application levels. ### Functions **Functions** are components of Azion Web Platform**, which enable serverless functions to be added to your applications or firewall configurations, relieving your infrastructure, performing functions closer to the end-user, ensuring the necessary agility and scalability to meet your business objectives. You can also choose a ready-to-use function, or even write your own. ### Network Shield This module allows the creation of filters by IP/CIDR, ASN addresses, or by countries (geolocation) through the configuration of Network Lists and the definition of business rules that will validate blocking or release *Criteria*, according to your need, specified on your Firewall configuration. ### Web Application Firewall Azion **Web Application Firewall (WAF)** protects your applications against threats such as SQL Injections, Remote File Inclusion (RFI), Cross-Site Scripting (XSS), and many others. The WAF analyses HTTP and HTTPS requests, detects and blocks threats before they can reach your infrastructure and affect your application performance. It works at layer 7 at the application level and is based on *scoring*. Each request is compared with a very rigorous and detailed set of application patterns and is given a score, which is associated with a certain threat family. According to the score that this request has, it can be released or blocked. This happens directly in Azion's edge nodes before the threat reaches your origin or causes any damage. It's possible to customize the desired sensitivity, and have a differentiated blocking for each threat family. --- ## Clone for an firewall You can clone an existing firewall through **Azion API**. The new cloned firewall will have identical settings as the original one, including main settings, functions instances, and rules from Rules Engine. However, the domains associated with the original firewall won't be copied to the cloned one. You need to retrieve the [ID of the firewall](https://api.azion.com/#090fa5b0-3d68-4521-9a90-f4d93773f6d9) you want to clone and then run a POST request to clone it, providing a new name. --- ## Limits :::tip **Increase limits**

You can request to increase the limits based on your plan. Contact the [technical support team](/en/documentation/services/support/) to request it. ::: These are the **default limits**: | Scope | Limit | | ----- | ----- | | Network Lists entries | 20,000 lines | | ASN in a network list | 20,000 lines | | IP/CIDR in a network list | 20,000 lines | | Web Application Firewall | 128 kB | | Domains per firewall | 200 |