Table of Contents

Application Firewall: General Overview and Best Practices

Mitchell Ivany Updated by Mitchell Ivany

Read Time: 2 mins

What is an Application Firewall in Sonar?

An application firewall controls traffic to and from a specific application or service using configured rules and policies. Instead of only inspecting network packets like a traditional firewall, it evaluates application-layer behavior—such as what requests are allowed and what actions an app can perform—to determine whether to allow, restrict, or block communication. This helps prevent malicious activity even if an attacker gains some level of access.

In Sonar, the built-in application firewall is a web application firewall (WAF) that filters, monitors, and blocks HTTP/HTTPS traffic to and from a web application.

What are Application Firewall Rules used for?

Create rules in Settings > Security > Application Firewall Rules by clicking Create Application Firewall Rule. For each rule, you specify:

Application Firewall Rules let you control which IPs or subnets can access your Sonar instance.

  1. Description: for internal reference only—use a clear label so you can identify the rule later.
  2. Allowed Subnet/IP: the network range that can reach the application
Application Firewall Rules apply to all access paths to your Sonar instance, including:

Sonar UI (web browser)
Field Tech Mobile app
API access (external API clients and integrations)

If you use the Field Tech Mobile app, each device/network it connects from must come from an allowed (whitelisted) IP/subnet, or the app will be blocked.

Rules take effect as soon as the firewall is enabled in Settings > System Settings by checking Application Firewall.

Before enabling the firewall, add your current IP address (or local subnet) as an allowed rule to avoid locking yourself out.

Common IP Addresses to Allow Through the Firewall

In addition to your own IP address or local subnet, allow the IPs/subnets used by any services or devices that must reach your Sonar instance, including:

  1. RADIUS server
  2. Customer Portal
  3. Inline device(s)
  4. Integrations (for example, marketing providers, Preseem, webhooks)
  5. External API clients/configurations
  6. Field Tech Mobile app IPs/subnets (whitelist the IP/subnet used by each field tech device/network)
  7. API clients (any external systems calling the API must be allowed)

Common Mistakes to Avoid

Don’t enable the application firewall until you’ve added and clearly labeled all required allowed IPs/subnets—especially your own—so you don’t lose access to your instance.

 

How did we do?

Auth0: Overview

Contact