DigitalOcean Cloud Firewall

Athena can block attacking addresses on a DigitalOcean Cloud Firewall from an alert, a policy rule or Pallas. Cloud Firewall rules can deny traffic, and a deny rule wins over the allow rules for the same traffic. For each blocked address Athena adds two deny rules to the firewall you name, for all protocols and ports:

• inbound, from the address;
• outbound, to the address.

Unblocking removes the same two rules. Athena never changes your own rules.

Single IPv4 addresses only for now.

In DigitalOcean

1. The firewall. Use the Cloud Firewall already applied to the Droplets (or tags) you want to protect, under Networking → Firewalls. Its id is the last part of its address in the control panel. Do not create a separate firewall for Athena: a firewall with only deny rules would have no allow rules, and a Droplet whose only firewall it is would lose all inbound traffic.
2. API token. Under API → Tokens, generate a personal access token with Custom scopesfirewall:read and firewall:update only.

DigitalOcean allows 50 rules per firewall and 1,000 addresses in all of a firewall's deny rules together. Each blocked address takes two entries (inbound and outbound), so one firewall holds at most 500 blocked addresses; Athena refuses a block past the limit.

In the console

Admin → Integrations → DigitalOcean Cloud Firewall:

Field	Notes
API token	Never shown again once saved
Firewall id	For example bb4b2611-3d72-467b-8602-280330ecd65c

Test connection reads the firewall (nothing is changed), warns when it is not applied to any Droplet or tag, and shows how many addresses it denies. Save applies the change within a minute, and the Block dialog then offers Block on DigitalOcean Cloud Firewall.

How a block works

• Block adds the two deny rules. Blocking an address twice changes nothing.
• Unblock removes the deny rules for the address, inbound and outbound.