Firewall and rate limits
Each app has its own firewall. Rules run on every visit before AOZUMI serves the app, so blocked traffic never reaches your code.
Open the firewall
On the app, open Settings › Firewall. Two switches sit at the top:
- Rules on
- Turn it off to stop evaluating every rule at once. Turning it off asks first.
- Log-only mode
- Records what would be blocked or rate limited, without blocking anyone.
With no rules, everyone can reach the app, subject to its access settings. The firewall comes before access: a visitor must pass both.
Add a rule
- Select Add ruleGive it an optional Name.
- Choose an ActionAllow, Block or Log only.
- Set a PriorityLower numbers run first.
- Add conditionsPick what to match under When, and add more with Add condition (each reads And). Tick Not to match everything except the values.
- Select Add ruleIt applies within 30 seconds.
| Condition | Example values |
|---|---|
| IP or CIDR | 203.0.113.0/24, 2001:db8::/32 |
| Country | US, DE |
| Path prefix | /wp-admin |
| Path glob | /admin/** |
| Method | POST |
| User agent contains | curl |
Separate several values with commas; a condition matches when any value matches. A rule matches when all its conditions match. A rule can have up to 8 conditions, and an app up to 50 rules.
To change a rule, select Edit. Turn off… and Delete… both ask first and say what changes for visitors.
How rules run
- Rules run from the lowest priority number to the highest.
- Allow and Block stop at the first match. Allow also skips the request limit.
- Log only records the match and keeps going.
- A request that matches no Allow or Block rule goes on to the app.
The Action list also shows Challenge (coming soon, logs only). For now a Challenge rule only logs, like Log only.
Limit requests per visitor
Under Requests per visitor, select Set a limit. Enter a number of Requests (a multiple of 10, up to 10,000) Per 10 or 60 seconds, then Save. The limit counts per IP address.
A visitor over the limit gets HTTP 429 with a Retry-After header. Use Change or Remove later.
Test with log-only mode
Turn on Log-only mode before you add a strict rule. Block rules and the request limit are recorded as Would block and Would rate limit, and every request passes. Check Recent decisions, then turn log-only mode off.
Recent decisions
Recent decisions shows a small sample from the last 7 days, not every request: the outcome, the rule, the method and path, the country, and the visitor's network (never a full IP address).
Questions
- Do firewall changes need a deploy?
- No. Rules, the request limit and log-only mode apply within 30 seconds, without a deploy.
- What does a blocked visitor see?
- A request that matches a Block rule gets HTTP 403. A visitor over the request limit gets HTTP 429 with a Retry-After header.
- Can a broken firewall take my app offline?
- No. If AOZUMI cannot load an app's rules, it lets requests through rather than blocking them. AOZUMI's own sign-in and health check paths are never filtered.
- Who can change the firewall?
- Workspace owners and admins. Other members can see the rules.
Checked against the product on .