Firewall

The Easel Firewall evaluates incoming requests before they reach your application.

Use it to block known abusive traffic, protect sensitive routes, challenge suspicious browsers, or observe traffic patterns without changing application code.

Firewall components

The project firewall includes:

• Custom rules
• IP conditions inside custom rules
• Attack Mode
• Bot classification used by Attack Mode exemptions

Platform protections remain active independently of the project firewall.

Where to configure

1. Open the project.
2. Open Project settings.
3. Configure Custom WAF rules and Attack challenge mode.

Rule changes save on the project. The edge picks them up after a short delay. You do not need to redeploy to update rules.

Rule anatomy

A firewall rule has:

• A name
• One or more condition groups
• An action
• An enabled (active) state
• A position in the ordered list

Example:

Name: Block admin access outside the office
Conditions:
  Path starts with /admin
  AND
  IP is not any of the office addresses
Action:
  Deny

Conditions

Supported request fields include:

See Custom rules for the full condition and operator reference.

Actions

Default behavior

When no project rule matches, the request continues unless another security layer blocks or challenges it.

Firewall and application authorization

Firewall rules do not replace application authorization.

For example, an IP condition can reduce exposure of /admin, but the application must still require authenticated and authorized users.

Related guides

• Custom rules
• IP rules
• Attack Mode
• Security evaluation order
• Firewall observability