Every filter Arion ships, grouped by where it attaches. Listener filters run when a connection is accepted, before a filter chain is chosen. Network filters run on the connection's byte stream and end in a terminal filter. HTTP filters run per request inside the HTTP connection manager, in the order listed, ending in the router. Each page gives the exact @type URL, the accepted fields, and per-route override support; the filter chain concept explains how the three layers fit together.
Listener filters
| Filter | Purpose | Description |
|---|---|---|
| TLS inspector | Connection | Reads the SNI from the TLS ClientHello so filter chains can match on server name. |
| Proxy protocol | Connection | Consumes a PROXY protocol v1/v2 header and restores the original client address. |
| Local rate limit | Rate limiting | Caps the rate of accepted connections with a token bucket; excess connections are closed. |
Network filters
| Filter | Purpose | Description |
|---|---|---|
| RBAC | Authorization | Allows or denies connections by client address, destination and SNI. |
| Rate limit | Rate limiting | Checks each new connection against an external gRPC rate limit service, with quota caching. |
| Connection limit | Connection | Caps concurrently active connections per filter chain with a process-wide counter. |
| HTTP connection manager | Traffic | Terminal filter that speaks HTTP, runs the HTTP filter chain and routes requests. |
| TCP proxy | Traffic | Terminal filter that forwards the raw byte stream to an upstream cluster. |
HTTP filters
| Filter | Purpose | Description |
|---|---|---|
| CORS | Traffic | Answers preflight requests and stamps CORS headers on responses. |
| JWT authentication | Authentication | Validates JSON Web Tokens against configured providers and JWKS keys. |
| RBAC | Authorization | Allows or denies requests by header-based policies, overridable per route. |
| Cedar policy | Authorization | Evaluates Cedar policies over JWT claims and request context. |
| Local rate limit | Rate limiting | Rate-limits requests with an in-process token bucket, overridable per route. |
| User rate limit | Rate limiting | Keeps a separate rate limit bucket per caller, identified by a header. |
| External processing | Extensibility | Streams headers and bodies to an external gRPC processor that can mutate or answer them. |
| Wasm | Extensibility | Runs a WebAssembly module in-process on every request and response. |
| MCP gateway | AI | Serves a Model Context Protocol endpoint, maps tools onto REST, OpenAPI and MCP upstreams, and runs agent scripts in code mode. |
| Router | Traffic | The mandatory terminal filter that executes the routing decision and sends the request upstream. |