The Allowed IPs and Blocked IPs tabs let you explicitly permit or deny traffic from individual IP addresses or ranges before requests reach your application.
Allowed IPs: permit traffic from specific addresses or ranges without any additional security checks.
Blocked IPs: deny requests from specified addresses or ranges.
Both IPv4 and IPv6 addresses are supported. Rules must be created separately for each address type. In addition to individual addresses, you can define IP ranges using the first and last IP in the range. Up to 30 networks can be included in a single range. Subnet masks and CIDR notation are not supported.
In the domain dropdown in the top-right corner, select the domain you want to apply the rule to.
Open the tab for the type of rule you want to create: Allowed IPs or Blocked IPs.
Click Add IP/IP range. The Add IP form appears.
Fill in the fields:
Name: a label for the rule. Allowed characters are letters, numbers, spaces, periods, and colons.
Equality: select Equal to match the specified IP exactly, or Not to match all IPs except the one specified.
IP: the IP address to allow or block.
IP range (Optional): if you are defining a range, enter the last IP address in the range.
Description (Optional): a note about the rule purpose.
Click Save changes.
The rule appears in the list. The Status toggle is set to On by default. You can disable a rule at any time by toggling its status without deleting it.
Edit or delete a rule
In the CDB Technical Web Portal, navigate to WAAP > Firewall.
Select the domain from the dropdown.
Open the Allowed IPs or Blocked IPs tab containing the rule you want to manage.
Click the three-dot icon at the end of the rule row.
Select the action:
Edit: update the rule fields and click Save changes.
Delete: confirm deletion in the dialog that appears.
To delete multiple rules at once, select the checkboxes next to the rules and use the Actions dropdown that appears above the table.
WAAP Firewall rules allow or block traffic from individual IP addresses or IP ranges before requests reach the application. The Firewall Rules endpoints support the full lifecycle: create, update, toggle, and delete rules. Response examples include only the fields used in each step.
Retrieve all rules configured for a domain. Filter by action=allow or action=block to narrow results to one list type.
import gcore
import os
client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])
rules = client.waap.domains.firewall_rules.list(domain_id)
for rule in rules.results:
action = "allow" if rule.action.allow is not None else "block"
status = "enabled" if rule.enabled else "disabled"
print(f"{rule.id}: {rule.name} | {action} | {status}")
Rules match on either a single IP address or an IP range. Set action to {"allow": {}} to add to the Allowed IPs list, or {"block": {}} to add to the Blocked IPs list.
import gcore
import os
client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])
# Allow a single IP address
allow_rule = client.waap.domains.firewall_rules.create(
domain_id,
name="partner API server",
description="Trusted partner IP",
enabled=True,
action={"allow": {}},
conditions=[{"ip": {"ip_address": "203.0.113.42", "negation": False}}],
)
print(f"Created allow rule id={allow_rule.id}")
# Block an IP range
block_rule = client.waap.domains.firewall_rules.create(
domain_id,
name="datacenter scanner range",
enabled=True,
action={"block": {}},
conditions=[{
"ip_range": {
"lower_bound": "203.0.113.10",
"upper_bound": "203.0.113.20",
"negation": False,
}
}],
)
print(f"Created block rule id={block_rule.id}")
Save the id value from the response — it is required for all subsequent operations on the rule.
The table below describes the request body fields. Only name, enabled, action, and conditions are required.
Field
Required
Description
name
Yes
Rule label. Letters, numbers, spaces, periods, and colons only. Max 100 characters.
enabled
Yes
true to activate the rule immediately after creation.
action
Yes
{"allow": {}} for Allowed IPs list; {"block": {}} for Blocked IPs list.
conditions
Yes
Array with one entry. Use ip for a single address or ip_range for a range.
conditions[].ip.ip_address
Yes (single IP)
IPv4 or IPv6 address.
conditions[].ip.negation
No
true to invert the match — the rule applies to all addresses except the one specified. Default: false.
conditions[].ip_range.lower_bound
Yes (range)
First address in the range.
conditions[].ip_range.upper_bound
Yes (range)
Last address. The range spans up to 30 contiguous networks. CIDR notation is not accepted.
description
No
Free-text note about the rule.
Update a rule
A partner server's IP was rotated after a security incident — move it from the allowlist to the blocklist by changing only the action field. All other fields retain their current values when omitted from the request.
import gcore
import os
client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])
rule_id = 12345 # ID from the Create response
client.waap.domains.firewall_rules.update(
rule_id,
domain_id=domain_id,
action={"block": {}},
description="Compromised endpoint - moved to blocklist",
)
print("Rule moved to blocklist")
package main
import (
"context"
"fmt"
"os"
"strconv"
gcore "github.com/G-Core/gcore-go"
"github.com/G-Core/gcore-go/waap"
)
func main() {
client := gcore.NewClient()
domainID, _ := strconv.ParseInt(os.Getenv("WAAP_DOMAIN_ID"), 10, 64)
ruleID := int64(12345) // ID from the Create response
_ = client.Waap.Domains.FirewallRules.Update(
context.Background(),
ruleID,
waap.DomainFirewallRuleUpdateParams{
DomainID: domainID,
Action: waap.DomainFirewallRuleUpdateParamsAction{Block: waap.DomainFirewallRuleUpdateParamsActionBlock{}},
Description: gcore.String("Compromised endpoint - moved to blocklist"),
},
)
fmt.Println("Rule moved to blocklist")
}
