Custom firewall rules

Custom rules let you define project-specific security policies without modifying application code.

Rules are project-scoped: they apply to every hostname that serves that project, including preview URLs, production URLs, and custom domains.

Create a rule

Open the project.
Open Project settings.
Scroll to Custom WAF rules.
Choose Add rule.
Enter a descriptive name.
Add one or more conditions.
Select an action.
Review the rule order.
Toggle Active and save.
Confirm matches in firewall observability.

Clearing all rules and saving stores an empty ruleset.

How matching works

Rule order matters. Easel evaluates active rules from top to bottom. The first matching rule applies; lower rules are not considered for that request.
Condition groups (OR). A rule can have multiple groups. If any group matches, the rule matches.
Conditions inside a group (AND). Every condition in a group must be true for that group to match.
Negate. Inverts a single condition after the operator runs. Prefer explicit operators such as Does not equal or Is not any of for new rules.

Each condition has a type, an operator, and either a single value or a values list (one per line) for Is any of / Is not any of. Some types use a key (header name, query parameter name, or cookie name).

Types

Type	What is matched
Request path (normalized)	URL path with consistent trailing-slash handling.
Raw path	Path as received, without that normalization step.
Route pattern	The route pattern from your deployment that matched this request.
Method	HTTP method, compared in uppercase (`GET`, `POST`, …).
User-Agent	The `User-Agent` header.
Request header	A header by key. Legacy `Name:expected` in value is supported when key is empty.
Query string (full)	Everything after `?` in the URL.
Query parameter	A single query parameter; set key to the parameter name.
Cookie	A named cookie (key), or the raw `Cookie` header when key is empty.
Hostname	Host without port.
Environment	Deployment environment (`production` or `preview`).
IP / CIDR	Client IP after trusted proxy handling. See IP rules.
Edge region	The edge region that handled the request.
Geo continent / country	Continent or country derived from the client IP.
AS number	Autonomous system number (ASN) derived from the client IP.
Server action (Next.js)	Matches `Next-Action` (falls back to `Next-Router-State-Tree` if empty).

Operators

Label	Operand
Equals / Does not equal	Single value
Is any of / Is not any of	Values (one per line)
Starts with / Does not start with	Single value
Ends with / Does not end with	Single value
Contains / Does not contain	Single value
Matches expression / Does not match expression	Regular expression

Validate regex rules with Log first. Patterns that work in JavaScript may still fail to compile on the edge.

Geo and ASN

Geo country, geo continent, and ASN conditions use IP address data powered by IPLocate.io (CC BY-SA 4.0). Comparisons for country and continent are case-normalized to uppercase.

Trusted client IP

For IP, geo, and ASN conditions, the edge resolves the client IP from the connection that reaches Easel. Easel honors X-Forwarded-For only on its trusted edge path. Client-supplied forwarding headers from untrusted peers are ignored.

Actions

Action	Effect
Log	Records a firewall observation and continues to your app.
Deny (403)	Responds with 403 Forbidden. The request does not reach your deployment.
Challenge	Serves a browser proof-of-work checkpoint (same family of flow as Attack Mode). After success, the edge sets a session cookie (about one hour).
Bypass attack challenge	Skips project-wide Attack Mode only. Other platform protections still apply.
Redirect	Responds with an HTTP redirect. Set a 3xx status and Location (absolute `https://…` URL recommended).

Challenge rules use the same verification endpoint as Attack Mode. The edge always allows /.well-known/easel-challenge/* so verification can complete without looping.

Recommended rollout

Create a rule with Log and confirm traffic in observability.
Refine conditions until only the traffic you care about matches.
Change the action to Deny, Challenge, Bypass, or Redirect.

Observe first, then enforce.

Current limitations

No per-rule rate limiting in the dashboard yet.
No time-based IP ban from rule settings.
Rules are ordered; there is no separate priority number beyond list order.
TLS fingerprint matching is not available yet.

Examples

Block a sensitive path by country

Path starts with /admin
Country is not US
Action: Deny

Bypass Attack Mode for a webhook path

Path starts with /api/webhooks/
Action: Bypass attack challenge

Continue validating webhook signatures in application code.

Path equals /login
Method equals POST
User agent contains HeadlessChrome
Action: Challenge

Observe an API client before enforcing

Path starts with /api
Header x-client-version does not exist
Action: Log

On this page