In this section, you can:

• Define different locations and/or resources within your planet. For each one, you can:

  • Assign a security Profile. Profiles are defined elsewhere in the interface: this section is where you assign them and make them active for different locations within your planet.

  • Configure rate limiting (optional).

  • Configure content filtering (optional).

• Set a site/application into Report Only mode (usually used only for testing).

Managing Locations

The top right part of the screen shows the site that is currently being displayed for editing.

On the main part of this page, the various defined sections of the selected site are listed. The Default entry is always present.

Each entry is defined as follows:

To add a new Location, fill out the blank entry at the bottom and click Add. To delete a Location, click the Remove link next to its name.

Assigning a Security Profile to a Location

Once you have defined a Location, you can assign a Security Profile to it.

Within each Location entry, the Profile field is autocomplete. Typing the first few characters of a Profile name will populate the list appropriately, then select the desired Profile.

Setting Rate Limits for a Location

Once you have defined a Location and assigned a Profile to it, you can also (if desired) configure rate limits and content filtering for it.

This is synchronized protection: you can limit the request rate, according to any desired parameter, per URL or section, across the entire cluster, while keeping all the proxy servers in sync.

At the end of the Location's entry, click on "More" to open the Location Settings dialog.

This displays whatever limits have been defined for this location, and another line to add a new limit.

Each limit defines the number of requests allowed for a specific time period, defined in the TTL field. When a request is received that matches one or more Keys, an internal TTL timer starts, and Reblaze begins counting. If the Rate Limit is reached before the TTL period has ended, subsequent requests are blocked until the current TTL period ends.

Here are the possible attributes:

Key Composition Values

When counting the number of requests, Reblaze searches for the value of a Key. Each value has its own cumulative count.

Combining Keys into one rate limit (by entering their names together, separated by a space) allows for more granularity. Examples:

• remote_addr : Each IP will have its incoming requests counted, and evaluated separately against the Rate Limit.

• remote_addr uri Each combination of IP and URI will be counted, and evaluated separately against the Rate Limit. In other words, Reblaze will count the requests from each IP for each URI, maintaining separate cumulative counts for each combination. So, if a specific IP asks for multiple pages within a site, it will be allowed; but if it asks for the same page too many times, it will be blocked.

Here are the possible values for Key Composition.

Advanced String Manipulation in the Key Composition

You can use Lua to manipulate strings in the Key Composition field. Use the tostring() function to return a string into the field.

Usually there will also be a substring operation. This should come after the tostring(). Example: tostring():sub(1, 20)

Inside the tostring(), there must be a valid NGINX variable, usually from ngx.var or ngx.ctx. The full variables list can be found here.

Examples:

• Substring - Suffix last 5 char : tostring(ngx.ctx.args_table['foo']):sub(-,5)

• Substring - Prefix from 1st char to 5th char: tostring(ngx.ctx.args_table['foo']):sub(1,5)

If you need assistance with this feature, please feel free to contact support.

Content Filtering for a Location

For each Location, along with defining rate limits, you can also set up content filtering.

This is a powerful feature that allows you to require, or deny, exact values for specific headers, cookies, and arguments, based on regex matching.

Content filter example

The Filters do not have user-assigned descriptions or names (the Name field has a different meaning, described below) When a request is blocked based on the Content Filter, the request appears in the logs with a custom description constructed from the Filter's parameters.

To add a new Filter, enter values into the empty row in the list and click Add. Existing Filters can be deleted by clicking Remove.

When you are finished configuring rate limits and content filtering for a location, click Done. After you have edited all Locations, Save Changes and Publish Changes.

Enabling Report-Only Mode

At the bottom of the screen, the Report Only switch allows you to test your Reblaze configuration. Enabling this setting means that Reblaze will not block any traffic for this site/application; it will merely report on what it would have blocked otherwise. This is useful during a new deployment, since you can fine-tune and optimize your settings while avoiding false positives.

When you deploy Reblaze to protect your web assets, it acts as a proxy, receiving requests from clients (web visitors, mobile/native app users, etc.), blocking hostile traffic, and passing legitimate requests to your servers.

The Web Proxy section defines how Reblaze behaves in this role. It consists of three tabs:

• General Settings

• Application Profiles

• Security Profiles

Proxy settings are configured per site/application. To switch between them, click on the drop down menu on the right side.

After making edits to this section, don't forget to Save Changes and Publish them to the cloud.

Overview

The Application Profiles tab allows you to set appropriate security behaviors for your web applications.

Before configuring, ensure that the correct site is selected via the dropdown list at the upper right.

To add an entry to the list, click on the "+" button. To delete an entry, click on the "Remove" link next to its name.

Here are the fields for each Application Profile.

Purge Cache

If you'd like to clear cache on one of your websites on the platform, you can click the "Purge" button. Usually, the action takes around 5 minutes.

This part of the interface allows administration of three categories of settings, for the site that is currently selected at the top of the screen:

At the bottom, it also provides from the planet.

Upstream Servers

This section defines the servers that Reblaze will protect. In other words, these are the servers to which Reblaze will send the (legitimate) traffic it receives.

Within these settings, you can:

• Enable and configure load balancing, weighting and distributing traffic across your primary servers.

• Define backup servers, to which Reblaze will failover your traffic when your primary servers aren’t available.

• Take servers offline for maintenance by ticking a single box in the interface.

• Instruct Reblaze to keep individual users connected to the same server throughout their sessions.

Adding and deleting servers from this list is straightforward. To add a server, enter its IP in the “New Server” box and click Add, then fill out the rest of the information in the new entry. To delete an existing entry, click on the Delete link next to that entry.

The settings for each server in the list are as follows.

Proxy Settings

The Proxy Settings parameters define Reblaze’s behavior as a proxy, i.e. how Reblaze passes information back and forth between client and server.

Additional information

The Client’s IP Header Name (Upstream Side) setting defines how Reblaze passes the client's IP address to the upstream server. In addition to the IP, Reblaze also sends the client's geographic information (if it is available). The field names are:

Log File Parameters

The Log Files Parameters enables you to control the contents of the Reblaze-generated traffic logs.

Site Deletion

When you wish to remove a site from Reblaze, select it in the pulldown list in the upper right of the page. Then, at the bottom of the page, you will find a (disabled) Delete Site button.

To enable the button, check all three boxes next to it. (This is a safety measure to prevent accidental site deletions.) Once the button is enabled, clicking it will remove the specified site from Reblaze. Note that this action cannot be undone.

Before deleting a site from Reblaze, you should change your DNS settings to reroute your traffic, and then wait for the changes to propagate. Otherwise, Reblaze will still be receiving traffic, but the traffic will no longer be passed along to your server.