---
title: "Rules and list entries: IP, CIDR, path, ASN, country · camada"
description: "What a camada rule or list entry can match: IP, CIDR, path, session, TLS fingerprint, ASN and country, and which SDK positions can enforce each one."
url: https://www.camada.app/docs/rules
last_updated: 2026-10-26
---

Docs

# Rules and list entries

An allow-list entry or a manual block names one key. Every entry takes a reason and an optional expiry. An allow-list entry always wins over a block, wherever the two overlap.

## What you can key an entry on

These five key types are the ones you can write by hand, on the allow-list and on manual blocks alike.

| Key type | What it is | Enforced where |
| --- | --- | --- |
| `ip` | A single address, v4 or v6. | Any SDK or proxy in the request path. |
| `cidr` | A range. Nothing wider than a /8 is accepted. | Any SDK or proxy in the request path. |
| `path` | A path, in any case. Ending it in a slash makes a prefix. See below. | Any SDK or proxy in the request path. |
| `asn` | The autonomous system number as a decimal string, 1 to 4294967295. | Positions that see the IP-derived ASN. See below. |
| `country` | ISO 3166-1 alpha-2, uppercase, e.g. BR. | Positions that see the IP-derived country. See below. |

camada's own analysis blocks a wider set: a verdict can also name a session or a TLS fingerprint. Those are not key types you can write an entry for; they appear on findings and on the entity pages like any other key.

## How paths match

Paths match without regard to case, a trailing slash or percent-encoding, so `/admin` also covers `/Admin`, `/admin/` and `/%61dmin`.

- A key ending in a slash is a prefix and covers the directory itself: `/admin/` covers `/admin` and `/admin/users`.
- `.` and `..` are resolved, doubled slashes collapse and `;` parameters are dropped, so `/public/../admin` is `/admin`. An encoded slash, `%2F`, never counts as a separator.
- A block matches any of those spellings. An allow-list entry or a skip rule has to match the path both before and after `..` is resolved, so `/public/../admin` never borrows the exemption for `/public/`.
- A rule's path conditions work the same way: *is*, *starts with* and *matches regex* all ignore case.

## Country and ASN need a position that sees them

ASN and country are derived from the client IP by the position that collects the request. A Cloudflare Worker running [@camada/hono](https://www.camada.app/docs/hono) has them, because the platform puts `request.cf` in front of your handler with the ASN and the country on it; so do camada's own proxy and edge module, and CDN log sources.

`@camada/node` and `@camada/next` **do not see** them: inside your app the SDK has the forwarded request, not the connection. Where the position cannot see the signal, a country or ASN entry is stored and shown but never matches, and a challenge or block verdict on one of those keys is recorded and alerted rather than enforced. Nothing is guessed at. Each project's rules page in the app reports which key types it can actually enforce, worked out from the positions camada has really received traffic from; until a project has seen traffic the page says so instead of guessing. That report, not this table, is the answer for your project.

## Actions per verdict category

| Action | What happens |
| --- | --- |
| `block` | The SDK answers 403 before your handler runs. |
| `challenge` | The SDK serves a proof-of-work page, where it can. See below. |
| `alert` | Recorded and alerted, never enforced. |
| `ignore` | Recorded and nothing else. |

**Challenge is enforced by SDKs on snapshot v4 (@camada/node ≥ 0.1.0, @camada/next ≥ 0.1.0, @camada/hono ≥ 0.1.0, @camada/sveltekit ≥ 0.1.0, @camada/nuxt ≥ 0.1.0, @camada/remix ≥ 0.1.0, @camada/bun ≥ 0.1.0, @camada/deno ≥ 0.1.0, @camada/python ≥ 0.2.0, @camada/go ≥ 0.1.0, @camada/php ≥ 0.1.0, @camada/ruby ≥ 0.1.0, @camada/java ≥ 0.1.0, @camada/dotnet ≥ 0.1.0); older SDKs treat it as recommend.**

On an older SDK a challenge verdict therefore behaves exactly like alert-only: the row appears in your activity and in your alerts, and no traffic is stopped. The flow, the cookie and the version table are on the [challenge](https://www.camada.app/docs/challenge) page.

What camada scores before it ever reaches a rule: [how it works](https://www.camada.app/how-it-works).

## Sitemap

[Every page on this site](https://www.camada.app/sitemap.md)