---
title: Deny traffic from a set of IP addresses
description: Learn how to block specific IP addresses with the Vercel WAF API.
url: /kb/guide/deny-traffic-from-a-set-of-ip-addresses
canonical_url: "https://vercel.com/kb/guide/deny-traffic-from-a-set-of-ip-addresses"
last_updated: 2026-06-17
authors: DX Team
related:
  - /docs/rest-api/reference/endpoints/security/update-firewall-configuration
  - /docs/rest-api/reference/endpoints/security
  - /docs/security/vercel-waf/ip-blocking
  - /docs/security/vercel-waf/examples
  - /docs/security/vercel-waf/custom-rules
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

In the following example, we send a `PATCH` request to the [Update Firewall Configuration](/docs/rest-api/reference/endpoints/security/update-firewall-configuration) endpoint of the [Vercel REST API security group](/docs/rest-api/reference/endpoints/security). This request creates a new rule in your project's WAF configuration.

> Both the `conditionGroup` and `action` body parameters are **required** fields

This strategy can help you enhance security and manage traffic across all your project domains at once in the following possible cases:

- You identified that a specific IP network is associated with DDoS attacks or automated bot traffic.
  
- Certain sanctions or data protection laws require that you block traffic from certain IP networks.
  

To enable this across all your project domains, create an [IP Blocking rule](/docs/security/vercel-waf/ip-blocking#project-level-ip-blocking) using the following code:

``export async function PATCH() { let baseUrl = 'https://api.vercel.com/v1/security/firewall/config'; let teamId = 'team_a5j...'; let projectId = 'QmTrK...'; const body = JSON.stringify({ action: 'ip.insert', id: null, value: { action: 'deny', hostname: '*', ip: '12.34.56.0/24', notes: 'deny traffic from 12.34.56.0/24', }, }); let res = await fetch(`${baseUrl}?projectId=${projectId}&teamId=${teamId}`, { method: 'PATCH', headers: { Authorization: `Bearer ${process.env.VERCEL_TOKEN}`, 'Content-Type': 'application/json', }, body, }); if (!res.ok) { return Response.json( { status: 'Failed to update Firewall' }, { status: res.status }, ); } return Response.json({ status: 'New rule added to Firewall' }); }``

## Related

- [WAF Examples](/docs/security/vercel-waf/examples)
  
- [WAF Custom Rules](/docs/security/vercel-waf/custom-rules)