Access Rules

Access rules block traffic by IP address at the earliest point the kernel offers. A blocked packet is discarded before routing — it never reaches your application, and it never costs a context switch into user space.

This is the bluntest and cheapest control Synapse has. It answers one question — is this address allowed? — and answers it fast.

What it gives you

Blocking that costs nothing per rule. Matching is a map lookup, so the cost does not grow as the blocklist does. A hundred thousand blocked addresses are as cheap as ten.
Threat intelligence, applied automatically. Gen0Sec's feeds keep the blocklist current without you curating it.
Enforcement below your stack. No proxy in the path, no TLS termination, no application change.
Visibility into what it dropped, so a block is auditable rather than a silent disappearance.

How it works

A packet arrives and is inspected at the XDP hook, before routing.
Its source address is looked up in a kernel map.
It is passed or dropped there and then.
The drop is counted, and the address can be surfaced as an event.

Write an ASN, ship addresses

You write access rules in the terms you actually think in — this ASN, this country, this address — and the kernel still only ever compares addresses. Those are not in tension, because the translation happens before the rule reaches the agent.

Cerebellum resolves an ASN or a country code into the IP ranges it currently covers, using the Gen0Sec GeoIP database, and ships the resolved ranges. The agent receives addresses and nothing else.

You write	The agent receives
`AS15169`	Every prefix that ASN announces
A country code	Every range allocated to it
An address or CIDR	Itself, unchanged

That split is what keeps enforcement free. There is no lookup on the packet path — no GeoIP query per packet, no ASN resolution in the hot path, nothing that grows with the size of your policy. Just a map lookup on the source address.

It also means the resolution is as fresh as the last config generation, not as fresh as the packet. An ASN that announces a new prefix is covered once the config regenerates, not the instant it happens. For most policy that is the right trade; where it is not, match on something the agent evaluates itself.

What it genuinely cannot express

Not available here	Where it lives
TLS SNI, HTTP host or path	WAF
ML verdicts, IDS context, reputation score	Amygdala rules, evaluated on the host
Port, protocol, egress direction	Firewall Rules

Amygdala evaluates ip.src.asn and ip.src.country itself, against a local database — so the same question can be asked either way. Pre-resolved access rules are cheaper; an Amygdala rule is evaluated live and can be combined with signals that only exist on the host.

Where it runs

By default Synapse attaches only to physical uplink interfaces. Loopback, and CNI or virtual devices such as veth, cilium, docker and bridges, are skipped.

That default is protecting you on Kubernetes

Attaching XDP to a CNI device puts it on your cluster's own datapath. On Cilium nodes that breaks networking. The default exists to avoid it — override it only when you have a specific reason, and know which interface you are attaching to.

Limits worth knowing

Inbound only. The XDP hook sees traffic arriving. Egress control is Firewall Rules.
It cannot forward elsewhere. The kernel stage can pass, drop, or answer the sender in place; it has no verdict that sends a packet to another host or a scrubbing appliance.
Requires a capable kernel and privileges — Linux 4.18 or newer, and CAP_BPF plus CAP_NET_ADMIN.

Use cases

Apply a threat feed fleet-wide without touching any application.
Drop a scanning subnet at line rate across thousands of hosts at once.
Absorb a volumetric source without it consuming application capacity.
Keep an audit trail of what was blocked, and by which rule.

What it gives you​

How it works​

Write an ASN, ship addresses​

What it genuinely cannot express​

Where it runs​

Limits worth knowing​

Use cases​

See also​