How we made Firewall Rules

What this post added

This post details the technical evolution leading to the creation of Cloudflare's Firewall Rules. It describes the limitations of previous single-attribute firewall features (IP Access Rules, ASN matching, CIDR blocking, GeoIP matching, Page Rules) and the challenges of combining them. The post introduces a new, unified matching engine implemented in Rust, designed to handle complex expressions with multiple attributes. It highlights the inspiration drawn from Wireshark's display filter syntax for creating a human-readable and machine-parseable DSL for defining firewall rules. The post also details the internal data structures used to represent HTTP request properties for matching.