Skip to main content

Vercel Firewall

EntryGuard can manage IP allowlisting on Vercel projects using the Vercel Firewall (WAF) API. When users start sessions, their IP is added to a firewall rule on your Vercel project. When the session ends, the IP is removed.

Prerequisites​

  • A Vercel account with a project that has the Firewall enabled
  • A Vercel API token with access to the project
  • An existing firewall rule configured as an IP allowlist

Step 1: Create the Firewall Rule in Vercel​

Before configuring EntryGuard, you need to create a firewall rule in your Vercel project:

  1. Go to your Vercel project Settings > Firewall
  2. Click Add Rule
  3. Configure the rule:
    • Condition: IP Address — is not one of — 127.0.0.1
    • Action: Deny (or Challenge)
    • Name: Give it a descriptive name (e.g., "EntryGuard IP Allowlist")
  4. Save and publish the rule
  5. Copy the Rule ID from the rule details (you'll need it when creating the resource)
Why 127.0.0.1?

EntryGuard uses 127.0.0.1 as a placeholder IP. When there are no active sessions, the rule contains only this placeholder so the rule stays valid. When a session starts, the placeholder is removed and the user's real IP is added.

Step 2: Generate a Vercel API Token​

  1. Go to your Vercel Account Settings
  2. Click Create Token
  3. Give it a descriptive name (e.g., "EntryGuard")
  4. Set the scope to the team/project that contains your firewall rules
  5. Copy the token

Step 3: Add Vercel Credentials in EntryGuard​

  1. Navigate to Credentials in the admin sidebar
  2. Click Add Credential
  3. Fill in:
    • Name: A descriptive name (e.g., "Vercel Production")
    • Provider: VERCEL
    • Type: API Token
    • API Token: Paste your Vercel API token
  4. Click Create

EntryGuard will automatically verify the credential by calling the Vercel /v2/user API.

Step 4: Add a Vercel Resource​

  1. Navigate to Resources in the admin sidebar
  2. Click Add Resource
  3. Fill in:
    • Name: A descriptive name (e.g., "Production Frontend Firewall")
    • Credential: Select the Vercel credential you created
    • Provider: VERCEL
    • Resource Type: Firewall Rule
    • Vercel Project ID: Your Vercel project ID (e.g., prj_xxxxxxxxxxxx)
    • Rule ID: The firewall rule ID from Step 1
    • Team ID (optional): Your Vercel team ID (e.g., team_xxxxxxxxxxxx). Required if the project belongs to a team.
  4. Click Create
Finding your Project ID

You can find your Vercel project ID in the project settings, or from the URL when viewing the project in the Vercel dashboard.

How It Works​

When a user starts a session:

  1. EntryGuard reads the current firewall rule configuration from the Vercel API
  2. The user's IP is added to the IP condition list
  3. The 127.0.0.1 placeholder is removed (if present)
  4. The updated rule is written back via a PATCH request

When a session ends:

  1. The user's IP is removed from the IP condition list
  2. If no IPs remain, 127.0.0.1 is re-added as a placeholder
  3. The updated rule is written back

Supported Features​

FeatureSupported
Dynamic sessions (apply/revoke)Yes
Static IP rulesYes
Credential verificationYes
Resource verificationYes
Rule reconciliationYes
IPv6Yes

Troubleshooting​

"Firewall rule not found"​

The rule ID in the resource config doesn't match any active rule in the Vercel project. Verify:

  • The rule exists in the project's Firewall settings
  • The rule has been published (draft rules are not visible via the API)
  • The Rule ID is correct

Credential verification fails​

  • Ensure the API token is valid and not expired
  • If the project belongs to a team, make sure the Team ID is set in the resource config
  • Verify the token has sufficient permissions for the project