Configuration

Examples

Real-world configuration examples for IP blocking, geo-blocking, rate limiting, and more.

Real-world configuration examples for common firewall scenarios. All examples are available in the examples folder on GitHub.

Format note: every rules[] example below uses the legacy (Vercel-only) rule format (conditionGroup/active/mitigate.action) — that's what the real files in examples/ are written in today. If you're on Cloudflare or Fastly, don't copy these shapes directly; see [[Configuration#rules-unified-format]] for the format your config actually needs, and translate the condition/action using the field/operator/action tables there. The ips[] example is shape-compatible with both formats.

Basic Protection

IP Blocking

Block specific IP addresses or ranges:

json

{
  "ips": [
    {
      "ip": "192.168.1.100/32",
      "hostname": "*",
      "action": "deny",
      "notes": "Known attacker"
    },
    {
      "ip": "10.0.0.0/8",
      "hostname": "*",
      "action": "deny",
      "notes": "Internal range"
    }
  ]
}

hostname is optional — include it for your own documentation/filtering, omit it to apply the block everywhere.

The linked full example below uses a different technique — rules[] with ip_address conditions — which gives you the full condition/action machinery (multiple IPs per rule, actionDuration, combining with other conditions) instead of the simpler dedicated ips[] array shown above. Both are valid; pick ips[] for simple allow/deny lists and rules[] conditions when you need more control.

View full example →

Path Protection

Secure specific URL paths:

json

{
  "rules": [
    {
      "name": "Protect Admin",
      "active": true,
      "conditionGroup": [
        {
          "conditions": [
            { "type": "path", "op": "pre", "value": "/admin" }
          ]
        }
      ],
      "action": {
        "mitigate": { "action": "challenge" }
      }
    }
  ]
}

View full example →

Geo-Blocking

Country-based access control:

json

{
  "rules": [
    {
      "name": "Block High-Risk Countries",
      "active": true,
      "conditionGroup": [
        {
          "conditions": [
            {
              "type": "geo_country",
              "op": "inc",
              "value": ["CN", "RU", "KP"]
            }
          ]
        }
      ],
      "action": {
        "mitigate": { "action": "deny" }
      }
    }
  ]
}

View full example →

Method Restriction

Limit HTTP methods on specific paths:

json

{
  "rules": [
    {
      "name": "Read-Only API",
      "active": true,
      "conditionGroup": [
        {
          "conditions": [
            { "type": "path", "op": "pre", "value": "/api" },
            { "type": "method", "op": "inc", "value": ["PUT", "DELETE", "PATCH"] }
          ]
        }
      ],
      "action": {
        "mitigate": { "action": "deny" }
      }
    }
  ]
}

View full example →

Advanced Security

Rate Limiting

Prevent abuse through rate limits:

json

{
  "rules": [
    {
      "name": "API Rate Limit",
      "active": true,
      "conditionGroup": [
        {
          "conditions": [
            { "type": "path", "op": "pre", "value": "/api" }
          ]
        }
      ],
      "action": {
        "mitigate": {
          "action": "rate_limit",
          "rateLimit": {
            "requests": 100,
            "window": "60s"
          }
        }
      }
    }
  ]
}

View full example →

Challenge Rules

Bot prevention with browser challenges:

json

{
  "rules": [
    {
      "name": "Challenge Suspicious Traffic",
      "active": true,
      "conditionGroup": [
        {
          "conditions": [
            { "type": "path", "op": "pre", "value": "/login" }
          ]
        }
      ],
      "action": {
        "mitigate": { "action": "challenge" }
      }
    }
  ]
}

View full example →

Redirect Rules

Traffic redirection:

View full example →

Conditional Rules

Complex condition group combinations:

View full example →

Specialized Rules

User Agent Filtering

Filter by browser or client type:

View full example →

Header-Based Rules

Rules based on HTTP headers:

View full example →

Mixed Rules

Multiple protection layers in a single configuration:

View full example →

Related Pages

Configuration — Configuration file reference
Templates — Pre-built rule templates
Commands Overview — CLI command reference

This content is sourced from the GitHub Wiki.