Firewall

Firewall is a resource in the Azion platform that protects workloads running on its globally distributed infrastructure by inspecting and filtering traffic close to the requester—before it reaches the application. Its composable architecture allows you to combine powerful modules—DDoS Protection, Web Application Firewall, Network Shield, Bot Manager, and Functions—to address specific aspects of traffic inspection and threat mitigation.

These capabilities can be used to build a comprehensive security policy that matches your workload’s requirements, while leveraging the platform’s global reach and low-latency performance.

Advantages of using Firewall:

• Low-latency access, requests and responses.
• Prevention of cybercriminals from reaching your origin/server by processing and blocking unwanted requests on the Azion Global Infrastructure.
• Highly programmable, modular, and extendible.
• Creation of allowed rules, blocklists, and greylists based on IP/CIDR address, ASN, or user location.
• Protection of applications from the Tor network and other malicious traffic sources, including botnets, malware, proxies, and others.
• Access rate limitation to applications using complex criteria and multiple buckets.
• Mitigation of Denial of Service (DoS and DDoS) attacks.
• Protection against OWASP Top 10 threats and others.
• Implementation of bot mitigation techniques, including blocklists, fingerprints, tampering protection, brute force prevention, advanced rate limiting, human challenge, and others.
• Integration of Azion curated functions or third-party software in Firewall for extended functionalities, such as IP reputation, fingerprint, JSON Web Tokens (JWT), credential stuffing, account takeover, price scraping, contact scraping, and others.

For more details on the product’s accounting, see the pricing page.

Implementation

How Azion Firewall works

By using Azion as your web development platform, you can create security settings on Firewall to protect your applications. Those firewall settings represent a set of rules that will be applied to the domains of your applications.

An firewall consists in an identification name, all your application domains where Firewall should be applied, what are the applied modules, and what are the security rules configured in the Rules Engine tab.

Rules Engine for Firewall

After activating the modules you want, you must configure your security rules in the Rules Engine tab. The rules you configure will run sequentially until the request is blocked or restricted or until all your rules are processed, at which point the request is released. The request’s data stream only passes onto your application if none of your Firewall rules block or reject the request, ensuring that malicious requests don’t reach your application.

Each rule is made of Criteria (conditionals) and Behaviors (commands). The Behaviors setup will run if the conditions are met. For example, you can set up rules to block requests that come from IPs that are in a blocklist or even make up rules to exclude IPs that are in the allowed rules list. In this example, “block” is the Behavior, while the IP of the request is in the blocklist and not present in the allowed rules is the condition (Criteria).

The Criteria and Behaviors available in Firewall depend on the modules you have enabled in the firewall main configuration. Here’s the list of Criteria and Behaviors available to each Firewall module:

List of Criteria and Behaviors available to each Firewall module:

About Firewall modules

DDoS Protection

The DDoS Protection module protects your content and applications against Distributed Denial of Service (DDoS) attacks, as it detects attacks using advanced algorithms that run on Azion’s distributed network. This distributed network is connected to several mitigation centers to guarantee mitigation during large-scale attacks, both at the network and application levels.

Functions

Functions are components of Azion Web Platform**, which enable serverless functions to be added to your applications or firewall configurations, relieving your infrastructure, performing functions closer to the end-user, ensuring the necessary agility and scalability to meet your business objectives. You can also choose a ready-to-use function, or even write your own.

Network Shield

This module allows the creation of filters by IP/CIDR, ASN addresses, or by countries (geolocation) through the configuration of Network Lists and the definition of business rules that will validate blocking or release Criteria, according to your need, specified on your Firewall configuration.

Web Application Firewall

Azion Web Application Firewall (WAF) protects your applications against threats such as SQL Injections, Remote File Inclusion (RFI), Cross-Site Scripting (XSS), and many others. The WAF analyses HTTP and HTTPS requests, detects and blocks threats before they can reach your infrastructure and affect your application performance.

It works at layer 7 at the application level and is based on scoring. Each request is compared with a very rigorous and detailed set of application patterns and is given a score, which is associated with a certain threat family. According to the score that this request has, it can be released or blocked. This happens directly in Azion’s edge nodes before the threat reaches your origin or causes any damage. It’s possible to customize the desired sensitivity, and have a differentiated blocking for each threat family.

Clone for an firewall

You can clone an existing firewall through Azion API.

The new cloned firewall will have identical settings as the original one, including main settings, functions instances, and rules from Rules Engine. However, the domains associated with the original firewall won’t be copied to the cloned one.

You need to retrieve the ID of the firewall you want to clone and then run a POST request to clone it, providing a new name.

Limits

These are the default limits: