---
title: "Filters"
url: "/reference/filters/"
kind: "hub"
summary: "The complete filter catalogue, grouped by where a filter attaches: listener, network or HTTP."
---

> Arion site index: [/llms.txt](/llms.txt)

# Filters

The complete filter catalogue, grouped by where a filter attaches: listener, network or HTTP.

Every filter Arion ships, grouped by where it attaches. Listener filters run when a connection is accepted, before a filter chain is chosen. Network filters run on the connection's byte stream and end in a terminal filter. HTTP filters run per request inside the HTTP connection manager, in the order listed, ending in the router. Each page gives the exact `@type` URL, the accepted fields, and per-route override support; the [filter chain concept](@/docs/concepts/filter-chain.md) explains how the three layers fit together.

## Listener filters

| Filter | Purpose | Description |
|---|---|---|
| [TLS inspector](@/reference/filters/listener/tls-inspector.md) | Connection | Reads the SNI from the TLS ClientHello so filter chains can match on server name. |
| [Proxy protocol](@/reference/filters/listener/proxy-protocol.md) | Connection | Consumes a PROXY protocol v1/v2 header and restores the original client address. |
| [Local rate limit](@/reference/filters/listener/local-rate-limit.md) | Rate limiting | Caps the rate of accepted connections with a token bucket; excess connections are closed. |

## Network filters

| Filter | Purpose | Description |
|---|---|---|
| [RBAC](@/reference/filters/network/rbac.md) | Authorization | Allows or denies connections by client address, destination and SNI. |
| [Rate limit](@/reference/filters/network/rate-limit.md) | Rate limiting | Checks each new connection against an external gRPC rate limit service, with quota caching. |
| [Connection limit](@/reference/filters/network/connection-limit.md) | Connection | Caps concurrently active connections per filter chain with a process-wide counter. |
| [HTTP connection manager](@/reference/filters/network/http-connection-manager.md) | Traffic | Terminal filter that speaks HTTP, runs the HTTP filter chain and routes requests. |
| [TCP proxy](@/reference/filters/network/tcp-proxy.md) | Traffic | Terminal filter that forwards the raw byte stream to an upstream cluster. |

## HTTP filters

| Filter | Purpose | Description |
|---|---|---|
| [CORS](@/reference/filters/http/cors.md) | Traffic | Answers preflight requests and stamps CORS headers on responses. |
| [JWT authentication](@/reference/filters/http/jwt-authn.md) | Authentication | Validates JSON Web Tokens against configured providers and JWKS keys. |
| [RBAC](@/reference/filters/http/rbac.md) | Authorization | Allows or denies requests by header-based policies, overridable per route. |
| [Cedar policy](@/reference/filters/http/cedar-policy.md) | Authorization | Evaluates Cedar policies over JWT claims and request context. |
| [Local rate limit](@/reference/filters/http/local-rate-limit.md) | Rate limiting | Rate-limits requests with an in-process token bucket, overridable per route. |
| [User rate limit](@/reference/filters/http/user-rate-limit.md) | Rate limiting | Keeps a separate rate limit bucket per caller, identified by a header. |
| [External processing](@/reference/filters/http/ext-proc.md) | Extensibility | Streams headers and bodies to an external gRPC processor that can mutate or answer them. |
| [Wasm](@/reference/filters/http/wasm.md) | Extensibility | Runs a WebAssembly module in-process on every request and response. |
| [MCP gateway](@/reference/filters/http/mcp-gateway.md) | AI | Serves a Model Context Protocol endpoint, maps tools onto REST, OpenAPI and MCP upstreams, and runs agent scripts in code mode. |
| [Router](@/reference/filters/http/router.md) | Traffic | The mandatory terminal filter that executes the routing decision and sends the request upstream. |