Adding an IP Firewall to Fastify Without Cloudflare
Add an IP firewall to Fastify without Cloudflare, a CDN or DNS changes: a one-line SecureNow preload with a managed blocklist, or your own onRequest hook.
Adding an IP Firewall to Fastify Without Cloudflare
Fastify's onRequest hook is the right place if you want application-level control. The SecureNow preload is the right place if you want a managed known-bad IP feed with zero maintenance.
Option 1: SecureNow preload (recommended)
npm install securenow
node -r securenow/firewall-only server.js
A known-bad IP feed refreshed hourly, plus your own blocklist. No Fastify code changes.
Option 2: Fastify hook
import Fastify from 'fastify';
const app = Fastify({ trustProxy: 1 });
const blocklist = new Set();
// ... populate from feed
app.addHook('onRequest', async (req, reply) => {
const ip = req.headers['x-forwarded-for']?.toString().split(',')[0]?.trim() || req.ip;
if (blocklist.has(ip)) {
return reply.code(403).send('Forbidden');
}
});
Workable for small static lists. For a feed refreshed hourly, the preload is the practical choice.
Custom blocklist + SecureNow
You can layer custom rules on top of the SecureNow base list. From the dashboard, CLI, or API:
npx securenow blocklist add 1.2.3.4 --reason "manual block — abuse report 2026-05-09"
Your custom rules sync to running SDK instances within ~10 seconds.
Verifying
npx securenow firewall status
Or test a specific IP:
npx securenow firewall test-ip 185.220.101.42
Related
Frequently Asked Questions
Does Fastify have a built-in IP firewall?
No — `@fastify/rate-limit` exists for rate limiting but not for reputation-based blocking. The SecureNow preload covers this without Fastify-specific code.
Can I combine the firewall with rate-limit?
Yes. The firewall preload runs below Fastify; rate-limit runs as a Fastify plugin. Different layers, no conflict.
What about Fastify v5?
Same setup. The preload sits at the HTTP server level — Fastify version doesn't matter.
Recommended reading
Block one IP, a CIDR range, or a single route and method in a Node.js app within seconds, with no code change: setup, scoping, CLI, MCP, verification and undo.
Oct 27Built your app with a coding agent? 11 warning signs it needs a security audit, each checkable in five minutes, and how to run the full audit yourself.
Oct 26Part 1 of the AI security audit series: set up an AI coding agent to audit your app locally, connect SecureNow, and run your first threat-model pass.
Jul 24