Edge rules apply to every name of the zone unless you limit them with hosts. Every change is a new zone version and accepts --reason, --dry-run, --yes and --wait.
rules list
rules list <zone> [--json]The zone's rules with their id, kind, details, action, the names they are limited to and their note.
rules add
rules add <zone> kind=… key=value … [hosts:='["a.example.com"]'] [note=…] --reason "…"kind | Keys |
|---|---|
ip | ip (an address or a CIDR range, such as 203.0.113.0/24), action (block or allow). |
geo | country_code (two letters, such as ES), action (block or allow). |
waf_exception | rule_id (required: the WAF rule to skip), path_pattern (empty: every path). |
rate_limit | rpm (required: requests per minute), burst (default 0), path_pattern, method. |
Every kind also takes:
| Key | Meaning |
|---|---|
hosts:='["a.example.com"]' | Limit the rule to these names of the zone. Without it, it applies to all of them. |
note | A note, up to 500 characters. |
openwaf-cloud ctl rules add example.com kind=ip ip=203.0.113.0/24 action=block note="Scanner" --reason "Block scanner"
openwaf-cloud ctl rules add example.com kind=geo country_code=ES action=allow --reason "Allow Spain"
openwaf-cloud ctl rules add example.com kind=waf_exception rule_id=941100 path_pattern='/wp-admin/*' \
hosts:='["blog.example.com"]' --reason "Editor false positive"For per-path rate limiting with more control (keys, periods, actions), use ratelimit.
rules rm
rules rm <zone> <id> --reason "…"Removes the rule with that id (from rules list).