---
title: Deny traffic from a set of IP addresses
description: Learn how to block specific IP addresses with the Vercel WAF API.
url: /kb/guide/deny-traffic-from-a-set-of-ip-addresses
canonical_url: "https://vercel.com/kb/guide/deny-traffic-from-a-set-of-ip-addresses"
published: 2025-11-03
last_updated: 2026-06-17
authors: DX Team
related:
  - /docs/rest-api/reference/endpoints/security/update-firewall-configuration
  - /docs/rest-api/reference/endpoints/security
  - /docs/security/vercel-waf/ip-blocking
  - /docs/security/vercel-waf/examples
  - /docs/security/vercel-waf/custom-rules
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---
<!-- docsgraph:related -->
## Related pages

> **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below.

- [Firewall API](https://vercel.com/docs/vercel-firewall/firewall-api?from=related) — Learn how to interact with the security endpoints of the Vercel REST API programmatically.
- [Examples](https://vercel.com/docs/vercel-firewall/vercel-waf/examples?from=related) — Learn how to use Vercel WAF to protect your site in specific situations.
- [IP Blocking](https://vercel.com/docs/vercel-firewall/vercel-waf/ip-blocking?from=related) — Learn how to customize the Vercel WAF to restrict access to certain IP addresses.
- [Web Application Firewall](https://vercel.com/docs/vercel-firewall/vercel-waf?from=related) — Learn how to secure your website with the Vercel Web Application Firewall \\(WAF\\)
- [Deny non-browser traffic or blocklisted ASNs](https://vercel.com/kb/guide/deny-non-browser-traffic-or-blocklisted-asns?from=related) — Learn how to block traffic from known threats with the Vercel WAF API.
- [Custom Rules](https://vercel.com/docs/vercel-firewall/vercel-waf/custom-rules?from=related) — Learn how to add and manage custom rules to configure the Vercel Web Application Firewall \\(WAF\\).
- [Blocking traffic from a specific IP address.](https://vercel.com/kb/guide/traffic-spikes?from=related) — Learn how to block traffic from a specific IP address.
- [Block PHP requests](https://vercel.com/kb/guide/block-php-requests?from=related) — Learn how to block traffic looking for .php vulnerabilies.
- [Suspicious Traffic in Specific Countries](https://vercel.com/kb/guide/suspicious-traffic-in-specific-countries?from=related) — Learn how to block traffic in specific geographical regions.

Full cross-link map for this page: [/kb/guide/deny-traffic-from-a-set-of-ip-addresses.graph.md](/kb/guide/deny-traffic-from-a-set-of-ip-addresses.graph.md)
<!-- /docsgraph:related -->


In the following example, we send a `PATCH` request to the [Update Firewall Configuration](/docs/rest-api/reference/endpoints/security/update-firewall-configuration) endpoint of the [Vercel REST API security group](/docs/rest-api/reference/endpoints/security). This request creates a new rule in your project's WAF configuration.

> Both the `conditionGroup` and `action` body parameters are **required** fields

This strategy can help you enhance security and manage traffic across all your project domains at once in the following possible cases:

- You identified that a specific IP network is associated with DDoS attacks or automated bot traffic.
  
- Certain sanctions or data protection laws require that you block traffic from certain IP networks.
  

To enable this across all your project domains, create an [IP Blocking rule](/docs/security/vercel-waf/ip-blocking#project-level-ip-blocking) using the following code:

```typescript
export async function PATCH() {
  let baseUrl = 'https://api.vercel.com/v1/security/firewall/config';
  let teamId = 'team_a5j...';
  let projectId = 'QmTrK...';

  const body = JSON.stringify({
    action: 'ip.insert',
    id: null,
    value: {
      action: 'deny',
      hostname: '*',
      ip: '12.34.56.0/24',
      notes: 'deny traffic from 12.34.56.0/24',
    },
  });

  let res = await fetch(`${baseUrl}?projectId=${projectId}&teamId=${teamId}`, {
    method: 'PATCH',
    headers: {
      Authorization: `Bearer ${process.env.VERCEL_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body,
  });

  if (!res.ok) {
    return Response.json(
      { status: 'Failed to update Firewall' },
      { status: res.status },
    );
  }

  return Response.json({ status: 'New rule added to Firewall' });
}
```

## Related

- [WAF Examples](/docs/security/vercel-waf/examples)
  
- [WAF Custom Rules](/docs/security/vercel-waf/custom-rules)