atoll firewall (atoll fw for short). Anyone in the project can look at it; changing it needs the Developer role.
Rules apply to every host of the project: production, previews and custom domains. Requests the firewall denies, challenges or rate limits are never billed.
How a request is checked
The platform checks each request in this order. The first step that ends the request wins:- Temporary blocks: IPs a rule blocked for a while (see persistent actions).
- IP blocking: your list of blocked IPs and ranges.
- Attack mode, when it is on.
- Custom rules, top to bottom.
- Managed rulesets: bot protection, AI bots, OWASP core rules.
Custom rules
A rule has conditions and an action. Conditions sit in groups: all conditions in a group must match, and the rule matches when any group does.field op value. --if adds one, --not (or a leading !) adds a negated one, and --or starts the next group.
Text comparisons ignore case.
in, starts_with, ends_with and contains take several values separated by commas (write \, for a comma inside a value). matches takes a regular expression in RE2 syntax. exists takes no value: header:x-api-key exists.
Actions
Rate limits
--limit requests per --window (10 s to 1 h) are allowed for each --key: ip, user_agent or header:<name>, and you can combine up to three. --algorithm is fixed-window (the default) or token-bucket. Over the limit, --then-limit decides: too-many-requests (429 with Retry-After, the default), deny, challenge or log. Counters are kept per region.
Persistent actions
deny, challenge and rate-limit can also block the client’s IP for a while, from 1 minute to 24 hours:
atoll fw blocks list; atoll fw blocks remove <ip> lifts a block at once.
IP blocking
--host the block applies to every host of the project.
Managed rulesets
--inspect-bodies (up to --max-body, 1 MB by default). Requests with larger bodies are then refused, so raise the limit before you turn this on for an app that takes uploads.
Attack mode
Attack mode challenges every visitor, except verified search engine bots and visitors who already solved the challenge. It applies at once, without publishing:--for turns it off again by itself after up to 24 hours; without it, it stays on until you turn it off.
Traffic and alerts
The Firewall tab shows the requests of the last 10 minutes, hour or day by action (allowed, logged, challenged, denied, rate limited), the rules that matched, and samples of mitigated requests. From the CLI:--by groups by ip, path, host, country, asn, user-agent or rule. Minute-by-minute data is kept for a day, hourly totals for 30 days.
When more than 100,000 requests are mitigated within 10 minutes, the project’s admins get an email and the tab shows an alert; at most one an hour.
Drafts, publishing and versions
Rules, IP blocks and managed rulesets are edited in a draft. Nothing changes for your visitors until you publish:atoll fw versions lists them and atoll fw restore <n> publishes an older one again as a new version.
atoll fw export -o firewall.json writes the whole config as JSON, and atoll fw import firewall.json loads one into the draft, for example to copy a firewall to another project.
Test with log first
A rule that matches more than you meant can lock out real visitors. Add new rules with--then log, publish, and watch them in the traffic view for a while (atoll fw traffic --by rule). When only the requests you meant show up, switch the action:
Examples
atoll fw rules list shows the rules with their ids; other rules commands take an id, a position or a name. atoll fw status shows the published version, unpublished changes, attack mode and your plan’s limits.
Plan limits
Saving or publishing past a limit fails with a hint to switch plans; see Billing.
Good to know
- Ktor servers are only filtered on the platform’s Kubernetes clusters. A server running in local mode filters web apps only, and the tab says so.
- Countries and networks come from the client IP. IP geolocation by DB-IP.