Firewall & Edge Security
Hubfly space Firewall protects public HTTP domains before traffic reaches your application containers. Configured per domain at the edge, it provides Web Application Firewall (WAF) protections, IP policies, bot detection, path restrictions, and rate limiting.
For identity-aware route protection, use Hubfly space Identity Access from the same Firewall and Identity area in the Dashboard. Firewall rules decide whether traffic is safe to inspect; identity policies decide who or what is allowed through.
Firewall Capability Summary
| Feature | Description | Example Rule |
|---|---|---|
| IP Access Policies | Allow or deny requests from specific client IP addresses or CIDR blocks. | deny 198.51.100.0/24 or allow 203.0.113.5 |
| User-Agent Blocking | Block scrapers, automated vulnerability scanners, or malicious crawlers. | Block curl, python-requests, or custom scraper signatures |
| Restricted Paths | Block probing attempts for sensitive files before reaching your container. | Block /.env, /.git, /wp-admin, /xmlrpc.php |
| Rate Limiting | Throttle request frequency per client IP to mitigate brute force & floods. | 20 r/s with burst allowance of 50 |
Edge Security Templates
Apply one-click security rule templates to public domains:
- Standard Guard: Balanced protection blocking common scanners, secret paths, and high-frequency bursts.
- CMS Shield: Hardens WordPress and PHP deployments by blocking
/xmlrpc.php, setup scripts, and login brute-forcing. - Under Attack Mode: Emergency strict rate limiting and aggressive bot challenges during traffic floods.