Firewall policies (ACL) and condition-based WAF rules

The Firewall provides an access control list (ACL) with condition-based matching, separate from per-endpoint Traffic Policy rules. Configure it in the dashboard under Firewall → Firewall Policy.

How policies work

Each policy evaluates incoming requests against a set of conditions. If all conditions match, the policy’s action is applied:

• Allow — permit the request through.
• Block — reject the request with a 403.

Policies are evaluated in priority order, and each can be enabled or disabled independently.

Condition types

Conditions can match on source_ip (IP or CIDR), country (GeoIP code), path, method, header, cookie, browser, user_agent, host, protocol, and port.

Operators

Each condition uses an operator: equals, not_equals, contains, starts_with, ends_with, regex, exists, or not_exists. Conditions can be combined with AND or OR logical operators.

AI-generated policies

Use the AI Magic Wand button when creating or editing a policy to generate rules from a natural-language description, for example: “Block all traffic from China targeting the /admin path, but allow my office IP 1.2.3.4”.