Skip to main content
A firewall policy tells the gateway to block every request that matches its match expressions. Use it to close internal paths, block a method on a route, refuse requests with a certain header, or block IP ranges, without changing your . To add one, open the app, go to Policies, click Add Policy, and pick Firewall. You only need a name, an environment, and match conditions.

​
Settings

​
string
required
Always ACTION_DENY. A request the firewall doesn’t match moves on to the next policy.
Example: block writes to an admin prefix from outside
A request must match all the expressions, so the example only blocks requests that match all three. To block two unrelated kinds of request, create two firewall policies.

​
Block or allow IP ranges

A remoteIp match with in blocks the listed ranges. With notIn it blocks everyone outside them, which turns the policy into an allowlist.
Example: allow /admin only from the office
The gateway uses the IP of the connection, never a header like X-Forwarded-For, so a client can’t claim a different address. It accepts IPv4 connections today, so IPv6 entries match no request yet. A firewall policy with no match expressions blocks every request to the . That’s a quick way to take a preview environment offline.

​
What the client sees

A blocked request gets 403 Forbidden with the code err:frontline:client:firewall_denied and the message Forbidden. The body is JSON or an HTML page depending on the caller’s Accept header. See Gateway errors. The caller isn’t told which policy matched. No later policies run, and the request doesn’t appear in your request log.

​
Next steps

Gateway policies

Every match expression type and how they combine.

Rate limit policy

Slow callers down instead of blocking them.
Last modified on October 6, 2026