92 lines
No EOL
1.9 KiB
Text
92 lines
No EOL
1.9 KiB
Text
---
|
|
title: Default allow behavior
|
|
---
|
|
|
|
import Tabs from "@theme/Tabs";
|
|
import TabItem from "@theme/TabItem";
|
|
|
|
# Default allow behavior
|
|
|
|
Anubis is designed to be as unintrusive as possible to your existing infrastructure.
|
|
|
|
By default, it allows all traffic unless a request matches a rule that explicitly denies or challenges it.
|
|
|
|
Only requests matching a DENY or CHALLENGE rule are blocked or challenged. All other requests are allowed. This is called "the implicit rule".
|
|
|
|
## Example: Minimal policy
|
|
|
|
If your policy only blocks a specific bot, all other requests will be allowed:
|
|
|
|
<Tabs>
|
|
<TabItem value="json" label="JSON" default>
|
|
|
|
```json
|
|
{
|
|
"bots": [
|
|
{
|
|
"name": "block-amazonbot",
|
|
"user_agent_regex": "Amazonbot",
|
|
"action": "DENY"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
</TabItem>
|
|
<TabItem value="yaml" label="YAML">
|
|
|
|
```yaml
|
|
- name: block-amazonbot
|
|
user_agent_regex: Amazonbot
|
|
action: DENY
|
|
```
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
## How to deny by default
|
|
|
|
If you want to deny all traffic except what you explicitly allow, add a catch-all deny rule at the end of your policy list. Make sure to add ALLOW rules for any traffic you want to permit before this rule.
|
|
|
|
<Tabs>
|
|
<TabItem value="json" label="JSON" default>
|
|
|
|
```json
|
|
{
|
|
"bots": [
|
|
{
|
|
"name": "allow-goodbot",
|
|
"user_agent_regex": "GoodBot",
|
|
"action": "ALLOW"
|
|
},
|
|
{
|
|
"name": "catch-all-deny",
|
|
"path_regex": ".*",
|
|
"action": "DENY"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
</TabItem>
|
|
<TabItem value="yaml" label="YAML">
|
|
|
|
```yaml
|
|
- name: allow-goodbot
|
|
user_agent_regex: GoodBot
|
|
action: ALLOW
|
|
- name: catch-all-deny
|
|
path_regex: .*
|
|
action: DENY
|
|
```
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
## Final remarks
|
|
|
|
- Rules are evaluated in order; the first match wins.
|
|
- The implicit allow rule is always last and cannot be removed.
|
|
- Use your logs to monitor what traffic is being allowed by default.
|
|
|
|
See [Policy Definitions](./policies) for more details on writing rules. |