Firewall Rules

Control which requests can flow through your proxy.

Firewall rules let you control exactly which requests flow through your proxy. Rules are evaluated in priority order on every request in firewall mode.

Firewall mode required

Firewall rules are only evaluated in firewall mode. Auto-auth mode passes all traffic through without rule evaluation.

Rule Anatomy

Field	Description
name	Human-readable label shown in logs and dashboard
priority	Lower number = evaluated first. Range 0–10000
celExpression	Boolean CEL expression; must evaluate to true for the rule to match
action	allow, deny, or hitl
enabled	Toggle without deleting the rule
description	Optional. For documentation purposes.

Actions

allow — request is forwarded; credentials are injected
deny — CIFP returns 403 immediately; the request is logged with action=deny
hitl — request is held pending human review; a notification appears in the dashboard; the operator can approve (forward) or deny within the configured timeout

Default Behaviour

If no rule matches a request, it is allowed by default. To create a deny-by-default proxy, add a catch-all rule at the end:

bash

# Rule: deny everything else
curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/rules \
  -H "Authorization: Bearer cifp_your_api_key" \
  -d '{
    "name": "deny-all",
    "priority": 9999,
    "action": "deny",
    "celExpression": "true"
  }'

Common Example Rules

bash

# Allow only api.openai.com (priority 10, action: allow)
request.host == "api.openai.com"

# Allow GET requests only (deny POSTs)
request.method == "GET"

# Allow specific path prefix
request.path.startsWith("/v1/chat/")

# Deny large uploads
int(request.headers["content-length"]) > 1048576

# Flag requests from unknown IPs for human review
!(client.ip in ["10.0.0.1", "10.0.0.2"])

# Allow only during business hours (UTC)
timestamp(request.headers["date"]).getHours() >= 9 &&
timestamp(request.headers["date"]).getHours() < 18

Creating Rules

bash

curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/rules \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name":          "allow-openai",
    "priority":      10,
    "action":        "allow",
    "celExpression": "request.host == \"api.openai.com\"",
    "enabled":       true
  }'

Updating & Toggling Rules

bash

# Disable a rule temporarily
curl -X PATCH https://cifp.vril.dev/api/proxies/proxy-id/rules/rule-id \
  -H "Authorization: Bearer cifp_your_api_key" \
  -d '{"enabled": false}

# Change priority
curl -X PATCH https://cifp.vril.dev/api/proxies/proxy-id/rules/rule-id \
  -d '{"priority": 5}'

CEL Expression Reference

See the CEL Expression Reference for the complete list of available variables, functions, and operators.