# ASN rules

> Allow or block requests by the client's network (autonomous system) with the new edge rule kind asn, from the dashboard, the API, the CLI or MCP.

A new edge rule kind, `asn`, allows or blocks every address of an autonomous system: `{"kind": "asn", "asn": 64500, "action": "block"}`. Each edge node looks the client's ASN up in its local database; an address whose ASN is unknown never matches. Within your zone's rules, and then within the platform's, an ASN rule decides before a country rule, and an IP `allow` rule skips both. Blocked requests appear in the security events as `ASN Block`.

Add them in **Security → Firewall → Rules → Autonomous systems (ASN)**, with `POST /v1/orgs/{org}/zones/{zone}/rules` or the batch route, `rules add <zone> kind=asn asn=64500 action=block` in the CLI, or `add_rule` and `apply_rules_batch` in MCP.

See [IP, ASN and country rules](https://developers.openwaf.dev/waf/ip-and-country-rules/#asn-rules).