Description

Ensure the project has IP blocking rules for IP addresses or ranges that are known to be malicious or abusive, and that the list is reviewed regularly. Each entry should have a clear reason, and old or overly broad entries should be removed or narrowed.

Rationale

Some attacks come repeatedly from the same IP addresses or networks. IP blocking stops this traffic before any other rule runs, which is the fastest way to cut off a known attacker. The list must also be kept current, because old entries can block addresses that now belong to real users, and very broad ranges can cause outages.

Impact

  • Blocks known malicious IPs before other rules run

  • Stops repeated attacks from the same sources

  • Old or broad entries can block real users

Default Value

By default, the IP blocking list is empty. Project-level IP blocking allows up to 10 entries on Hobby and 100 on Pro.

Pre-Requisites

  • Project Administrator, team Member, or Security role

  • A list of IPs to block with a reason for each

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Firewall in the sidebar.

  5. Open Rules in the Firewall sidebar and scroll to the IP Blocking section.

  6. Review each entry's Host, IP Address, and Note. The Note should explain why the IP is blocked.

  7. Verify that required blocks exist and that no entry is old or broader than needed.

  8. If blocks are missing or entries need cleanup, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Firewall in the sidebar.

  5. Open Rules in the Firewall sidebar. In the IP Blocking section, select + Add IP (or use Add New > IP Block at the top right).

  6. Enter the Host, the IP address or CIDR range, and a Note explaining the reason, then save.

  7. In the IP Blocking section, delete entries that are no longer needed.

  8. Select Review Changes, then select Publish, to apply the changes.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Firewall in the sidebar and select Audit Log.

  5. Find the configuration from before the change, select Restore, and then Restore Configuration.

Reference