Adding an IP Firewall to Fastify Without Cloudflare
Fastify's onRequest hook + a managed blocklist gives you a real IP firewall in one line. No CDN, no DNS changes.
Adding an IP Firewall to Fastify Without Cloudflare
Fastify's onRequest hook is the right place if you want application-level control. The SecureNow preload is the right place if you want a managed 500k-IP blocklist with zero maintenance.
Option 1: SecureNow preload (recommended)
npm install securenow
node -r securenow/firewall-only server.js
500k IPs blocked, hourly refresh, automatic crawler allowlisting. No Fastify code changes.
Option 2: Fastify hook
import Fastify from 'fastify';
const app = Fastify({ trustProxy: 1 });
const blocklist = new Set();
// ... populate from feed
app.addHook('onRequest', async (req, reply) => {
const ip = req.headers['x-forwarded-for']?.toString().split(',')[0]?.trim() || req.ip;
if (blocklist.has(ip)) {
return reply.code(403).send('Forbidden');
}
});
Workable for small static lists. For 500k entries refreshed hourly, the preload is the practical choice.
Custom blocklist + SecureNow
You can layer custom rules on top of the SecureNow base list. From the dashboard, CLI, or API:
npx securenow blocklist add 1.2.3.4 --reason "manual block — abuse report 2026-05-09"
Your custom rules sync to running SDK instances within ~10 seconds.
Verifying
npx securenow firewall status
Or test a specific IP:
npx securenow firewall test-ip 185.220.101.42
Related
Frequently Asked Questions
Does Fastify have a built-in IP firewall?
No — `@fastify/rate-limit` exists for rate limiting but not for reputation-based blocking. The SecureNow preload covers this without Fastify-specific code.
Can I combine the firewall with rate-limit?
Yes. The firewall preload runs below Fastify; rate-limit runs as a Fastify plugin. Different layers, no conflict.
What about Fastify v5?
Same setup. The preload sits at the HTTP server level — Fastify version doesn't matter.
Recommended reading
Part 1 of the AI Security Auditing series. Set up an AI coding agent to audit your application's security locally — install SecureNow, connect your account, and run your first threat-model pass in minutes.
Jul 24A practical, end-to-end guide to auditing your application's security with an AI coding agent — find vulnerabilities at the code level, build detections at the runtime level, and never upload your codebase to do it.
Jul 24Part 2 of the AI Security Auditing series. Use an AI agent to audit your login, session, MFA, password-reset and magic-link flows for account-takeover paths — then catch the attempts in live traffic.
Jul 23