Suspicious Traffic in Specific Countries

Learn how to block traffic in specific geographical regions.
Last updated on November 23, 2024
Security

Scenario: When reviewing your site's traffic in the live monitor of your project's Firewall tab, you notice a traffic spike coming from Ireland, where you do not have customers and/or do not expect much traffic.

You view the traffic by country by selecting Default Web Traffic from the traffic grouping drop-down and Country for the secondary drop-down

  1. Select your project from the Vercel dashboard and select the Firewall tab.
  2. From the top right corner of the Firewall page, click the Configure button and then + New Rule.
  3. Type "Ireland Traffic" as Name and "Understand Ireland traffic spike" as Description.
  4. In the Configure section, set up the following If configuration:
  • If Country Equals.
  • Select Ireland in the third drop-down.
  1. In the Then section, select Log from the dropdown. Your rule should look like this:
    Rule for measuring traffic from Ireland
    Rule for measuring traffic from Ireland
  2. Select Save Rule.
  3. Apply the changes:
    • When you make any change, you will see a Review Changes button appear or update on the top right with the number of changes requested
    • Select Review Changes and review the changes to be applied
    • Select Publish to apply the changes to your production deployment
  4. Observe the traffic for this rule on the Firewall overview page.
  5. Update the rule's Then action to Deny and select Save Rule and apply the changes.
  6. Review the live monitor. The traffic from that region should now be zero.