Access Rules

• ASN
• Cookie
• Country
• Country Subdivision
• IP address
• JA3
• Referrer
• URL
• User agent
• HTTP method
• Media type (aka content type)
• File extension
• File size
• Request headers

Basic Access Controls #

• ASN: Identifies requests according to the autonomous system (AS) from which the request originated. Specify each desired AS by its autonomous system number (ASN).
• Cookie: Identifies requests by searching for a cookie name that matches the specified regular expression. Certain common characters (e.g., ?.+) have special meaning in a regular expression. Use a backslash to escape a special character.
• Country: Identifies requests by the country from which the request originated. Specify each desired country using a country code.
  Country access controls take precedence over country subdivision access controls.

  For example, if you define US within a whitelist, then state-specific access controls will be ignored for requests that originate within the United States.
  Example: The following value identifies requests from the United States: US
• Country Subdivision (ISO3166-2): Identifies requests by a country’s subdivision (e.g., state or province). Specify each desired subdivision using an ISO-3166-2 code.
  Country access controls take precedence over country subdivision access controls.

  For example, if you define US within a whitelist, then state-specific access controls will be ignored for requests that originate within the United States.
  Syntax:
  <Country Code>-<Subdivision Code>
  Example:
  The following value identifies requests from California: US-CA
• JA3: Premier only. Identifies requests by the JA3 fingerprint assigned to the request. A JA3 fingerprint identifies a client using key characteristics from a TLS request. This allows us to classify traffic across various IP addresses and ports.
• IP Address: Identifies requests by the requester’s IPv4 and/or IPv6 address.
  Key information:
  • Specify each desired IP address using standard IPv4/IPv6 and CIDR notation.
    Specify a subnet by appending a slash (/) and the desired bit-length of the prefix (e.g., 11.22.33.0/22).
  • Limit: You may specify up to 1,000 IP addresses or IP blocks per access rule. Whitelist, accesslist, and blacklist entries count towards this limit.
    Security Premier and Standard customers are allowed to create up to 2 access rules that may contain up to 10,000 IP addresses or IP blocks. Use the High-Capacity option to identify these two access rules. All other access rules are limited to a maximum of 1,000 IP addresses or IP blocks. You may reassign high-capacity status to another access rule by first clearing the High-Capacity option from an existing high-capacity access rule.
  • Certain services and applications, such as VPNs, mask a client’s IP address. Specifically, they will report an IP address of their choosing instead of the client’s real IP address. As a result, multiple devices and perhaps even users may end up sharing the same IP address.
• Referrer: Identifies requests by referrer. A successful match is found when the specified regular expression matches any portion of the Referer request header value.
  The Referer request header identifies the URL of the resource (e.g., web page) from which the request was initiated. The specified regular expression may match any portion of the entire URL including the protocol and hostname.
• URL: Identifies requests by searching for a value that matches the specified regular expression within the request URI.
  Do not include a protocol or a hostname (e.g., http://cdn.mydomain.com) when defining a regular expression for this access control.
  Certain common characters (e.g., ?.+) have special meaning in a regular expression. Use a backslash to escape a special character (e.g., main\.html\?user=Joe).
  Example:
  All of the entries in the following sample access control list will match a request for http://www.mydomain.com/marketing/images/ad001.png:
  /marketing/.*
  .*images.*
  .*/ad[0-9]*\.png
• User Agent: Identifies requests by the user agent that acted on behalf of a user to submit the request. A successful match is found when the specified regular expression matches any portion of the User-Agent request header value.

Whitelists #

• Traffic is whitelisted if it satisfies at least one whitelist criterion.
• Security automatically approves the delivery of whitelisted requests without inspecting them. As a result, all other security requirements are not applicable to whitelisted traffic.

Accesslists #

1. Whitelisted traffic is automatically allowed. All other traffic proceed to the next step.
2. Has an accesslist been defined?
   • Yes: Does the request satisfy at least one criterion in any accesslist?
     • Yes: Security will inspect the request.
     • No: Security will block the request.
   • No: Proceed to check whether it should be blacklisted.

Blacklists #

• Traffic is blacklisted when it satisfies all of the following conditions:
  • The request satisfies at least one blacklist criterion.
  • The request does not qualify for whitelisting or accesslisting.
• Security automatically flags blacklisted requests as threats without inspecting them.

• A whitelist, accesslist, and blacklist may consist of zero or more entries (e.g., IP address, country, referrer, etc.).
• A blank whitelist, accesslist, or blacklist is ignored.
• The order of precedence is:
  Whitelist > Accesslist > Blacklist
  For example, Security will inspect a request that satisfies both an accesslist and a blacklist. However, it will automatically allow the delivery of a request that satisfies a whitelist, an accesslist, and a blacklist.
• Specify only a single item per line.
• All entries within a URL, referrer, cookie, or user agent whitelist, accesslist, and blacklist are regular expressions.
  By default, a regular expression defines a case-sensitive match. Use syntax (e.g., [a-zA-Z]) to make it case-insensitive.
• Unlike whitelists and blacklists, a request must satisfy at least one criterion in each defined accesslist.
• The maximum number of entries varies by category.

  Category	Combined Limit (Whitelist, Accesslist, and Blacklist)
  ASN	200
  Cookie	200
  Country	600
  IP Address	1,000 Security Premier and Standard customers are allowed to create up to 2 access rules that may contain up to 10,000 IP addresses or IP blocks. Use the High-Capacity option to identify these two access rules. All other access rules are limited to a maximum of 1,000 IP addresses or IP blocks. You may reassign high-capacity status to another access rule by first clearing the High-Capacity option from an existing high-capacity access rule.
  Referrer	200
  URL	200
  User Agent	200

  Security Insights supports up to 25 entries for each of the above categories. Contact your account manager or our sales department at 1 (866) 200 - 5463 to upgrade your account.
  Whitelist, accesslist, and blacklist entries count towards this limit.
• Unlike managed rules, access controls are enforced regardless of whether the requested content will be served from cache or your web server.

Additional Access Controls #

• HTTP method
• Media type
• File extension
• File size
• Request headers

HTTP Methods #

• Valid: Security performs a threat assessment on requests whose HTTP method matches a marked option.
• Invalid: Security automatically sends an alert or blocks a request when its HTTP method does not match a marked option.
  Sample HTTP methods:
  GET | POST | OPTIONS | HEAD | PUT | DELETE

Anonmymous Proxy #

Media Types (aka Content Types) #

• Security restricts requests by media type when the Allowed Request Content Types option contains one or more value(s). Skip this requirement by setting this option to a blank value.
  If you would like to skip this check, make sure to remove all characters, including whitespace (e.g., a space character), from this option.
• If the Allowed Request Content Types option contains one or more value(s), then Security will check whether the request contains a Content-Type header.
  • Missing: If a request does not include the Content-Type header, then Security will proceed to the next security check within this threat assessment.
    A client should only include a Content-Type header when the request includes a payload (e.g., HTTP PUT and POST requests). HTTP GET requests should not include this header.
  • Present: If a request includes the Content-Type header, then Security will compare its value against the list of allowed values.
    • Match Found: If a request’s Content-Type header matches a media type defined by this option, then it will proceed to the next security check within this threat assessment.
    • Match Not Found: If a request’s Content-Type header does not match a media type defined by this option, then Security will consider this a violation of this access rule and enforce the security policy (e.g., alert or block) defined within your security application configuration.
• Add a media type by typing it and then pressing ENTER.
• Media types are case-insensitive.
• Sample media types:
  application/x-www-form-urlencoded
  multipart/form-data
  text/xml
  application/xml
  application/x-amf
  application/json

File Extensions #

• Security flags a request as a threat when its file extension, as determined by the request’s relative path, matches one defined by this option.
• File extensions are case-insensitive.
• Add a file extension by typing it and then pressing ENTER.
• Syntax:
  .<File Extension>
  Sample list:
  .bat
  .cfg
  .dll

File Size #

Request Headers #

• Security flags a request as a threat when it contains a header whose name matches one defined by this option.
• Header names are case-insensitive.
• Add a request header by typing it and then pressing ENTER.

Access Rule Administration #

• Administer access rules from the Access Rules page.
• Apply an access rule to production traffic by adding it to a Security Application configuration and then determining how it will be enforced. Multiple Security Application configurations may use the same access rule. Leverage this capability to tailor security screening by application or traffic profile.
• It may take up to 2 minutes for an updated access rule to be applied across our entire network.

1. Navigate to the Access Rules page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Access Rules.
2. Click + New Access Ruleset.
3. In the Name of Rule option, type the unique name by which this access rule will be identified. This name should be sufficiently descriptive to identify it when setting up a Security Application configuration.
4. Define the desired whitelists, accesslists, and blacklists.
   1. From the Add an Access Control option, select the desired category (IP, Country, Referrer, etc.).
   2. Click + Whitelist, + Blacklist, or + Accesslist.
   3. Add a value by typing it and then pressing ENTER. Repeat this step as needed.
      All entries within a URL, referrer, cookie, or user agent whitelist, accesslist, and blacklist are regular expressions.
   4. Repeat steps 4.2 and 4.3 if you need to add another type of access control for this category.
   5. Repeat steps 4.1 - 4.4 to add whitelists, accesslists, and blacklists for other categories.
5. Define which HTTP methods and media types are allowed and which file extensions and request headers are disallowed.
   1. If the Advanced Settings section is collapsed, click on it to expand it.
   2. From the Allowed HTTP Methods section, verify that only the HTTP methods that should be allowed are marked. If the desired HTTP method is not listed, then you may manually define it in the Other HTTP Methods option by typing it and then pressing ‘ENTER’.
      Requests that use a disallowed HTTP method are deemed a threat.
   3. In the Response Header Name option, set the name of the response header that will be included with blocked requests. This name may only consist of alphanumeric characters and dashes.
   4. In the Single File Upload Limit option, define the maximum file size, in bytes, for a POST request.
   5. From the Allowed Request Content Types option, verify that the list only contains the media types that should be allowed.
      Add a media type by typing it and then pressing ENTER. Remove a media type by clicking the x icon that appears directly to the right of it.
      Requests that use a disallowed media type are deemed a threat.
   6. From the Extension Blacklist option, verify that all of the listed file extensions should be blocked.
      Add a file extension by typing it and then pressing ENTER. Remove a file extension by clicking the x icon that appears directly to the right of it.
      A request is blocked when its file extension, as determined by the request’s relative path, matches a value defined within this option.
   7. From the Header Blacklist option, add the set of request headers that should be blocked.
      Add a request header by typing it and then pressing ENTER. Remove a request header by clicking the x icon that appears directly to the right of it.
      A request is blocked when it contains a header whose name matches a value defined within this option.
6. Click Save.

1. Navigate to the Access Rules page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Access Rules.
2. Click on the desired access rule.
3. Make the desired changes.
4. Click Save.

1. Check your Security Application configurations to verify that the desired access rule is not in use.
2. Navigate to the Access Rules page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Access Rules.
3. Click on the desired access rule set.
4. Click Delete.
5. Click Confirm.

Version Control #

• View a previous version of a configuration.
• Reactivate a previous version of a configuration.
• Compare a previous version of a configuration to the current version.

1. Load the desired security configuration (e.g., access rule, rate rule, or custom rule).
2. Click Versions.

   

3. Click on the desired version to view it.

   

4. Optional. Compare the version selected in the previous step to the current version by clicking Diff. Differences between those two versions are highlighted in green (new or updated lines) and red (modified or deleted lines).
5. Optional. Reactivate the version selected in step 3 by clicking Reactivate. Click Reactivate this version to confirm that it will be reactivated.