Download the PHP package magentron/laravel-firewall without Composer

On this page you can find all versions of the php package magentron/laravel-firewall. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of magentron/laravel-firewall

Informations about the package laravel-firewall

magentron/laravel-firewall

Laravel IP firewall — whitelist, blacklist, and attack blocking.

Fork of antonioribeiro/firewall (originally published as pragmarx/firewall), modernized for PHP 8.1+ and Laravel 10–13.

Version matrix

Laravel PHP
10 8.1, 8.2
11 8.2, 8.3
12 8.2, 8.3, 8.4
13 8.3, 8.4

The cell list is kept in docker/matrix.txt (single source of truth for local Docker runs) and mirrored in .forgejo/workflows/tests.yml.

Local matrix testing

Run the full matrix or a single cell locally via Docker:

Cells run inside pre-built thecodingmachine/php CLI images, pinned by digest in docker/digests.txt for reproducibility. The repository is mounted read-only and copied to a scratch directory inside the container, so composer require cannot mutate the host composer.json or vendor/.

Refreshing image digests. Update docker/digests.txt when adding a new PHP version or pulling in upstream base-image changes. The refresh command is documented in the header of that file; after running it, commit the updated digests alongside any matrix changes.

Installation

The service provider and Firewall facade are auto-discovered via extra.laravel in composer.json.

Publish configuration

This writes config/firewall.php to your application.

Run migrations (optional, database mode)

Set firewall.use_database = true in the config to persist IP lists in the database. When false (default), lists are kept in config arrays only.

Middleware

Three named middleware aliases are registered automatically:

Alias Behaviour
fw-block-blacklisted Returns 403 for blacklisted IPs; lets others through
fw-only-whitelisted Returns 403 for non-whitelisted IPs; lets whitelisted through
fw-block-attacks Returns 403 when attack-blocker threshold is exceeded

Usage in routes

Facade API

Supported IP formats

Artisan commands

Command Description
firewall:whitelist <ip> Add IP to whitelist
firewall:blacklist <ip> Add IP to blacklist
firewall:remove <ip> Remove IP from all lists
firewall:clear Remove all IPs from lists
firewall:list Display all stored IPs
firewall:updategeoip Download/update GeoLite2 database
firewall:cache:clear Flush the firewall in-memory cache

IP detection and proxy support

This fork delegates IP resolution entirely to Laravel's Request::getClientIp(). That method honors Symfony's Request::$trustedProxies, which Laravel configures via the TrustProxies middleware.

If your application runs behind Cloudflare, an AWS ALB, or any other reverse proxy, configure TrustProxies once and IP detection works automatically — no package-specific configuration needed.

Cloudflare example — add Cloudflare's published IP ranges to App\Http\Middleware\TrustProxies:

See Laravel's trusted proxy documentation for details.

Migrating from pragmarx/firewall: The previous version read HTTP_CF_CONNECTING_IP and HTTP_X_FORWARDED_FOR headers directly, bypassing Laravel's proxy trust list. This was a spoofing risk. The new behavior is safer: configure TrustProxies and the right IP will be detected.

GeoIP / country filtering

Country-based filtering (country:us, country:br, etc.) requires a MaxMind GeoLite2-Country database.

Automatic download

Set the environment variable and run the Artisan command:

Or add to .env:

A free license key can be obtained from MaxMind.

Manual placement

Download GeoLite2-Country.mmdb from MaxMind and place it at the path configured in firewall.geoip_database_path (defaults to <package>/src/config/geoip/GeoLite2-Country.mmdb).

Graceful degradation

When no database file exists, country lookups return null silently. Country filtering is skipped and no exception is thrown. Users who don't need country features are unaffected.

Migrating from pragmarx/firewall

magentron/laravel-firewall is a true drop-in replacement: it reuses the PragmaRX\Firewall PHP namespace and declares a Composer replace for pragmarx/firewall, so Composer's dependency resolver will accept this package wherever pragmarx/firewall is required. Existing code that imports PragmaRX\Firewall\... classes continues to work without modification.

Config file keys and defaults, middleware aliases (fw-only-whitelisted, fw-block-blacklisted, fw-block-attacks), the Firewall facade, Artisan command signatures, the database table schema, and the AttackDetected event class are all unchanged.

Steps

  1. Remove pragmarx/firewall and install this fork:

  2. If you published the config previously, re-publish or manually verify it — config keys are identical, so the existing file will work.

  3. Review the behavioural changes in changelog.md — in particular, the trusted-proxy IP resolution hardening (see below) may require configuring Laravel's TrustProxies middleware if you run behind Cloudflare, AWS ALB, or similar.

License

BSD-3-Clause

Original work Copyright (c) 2014, Antonio Carlos Ribeiro
Fork modifications Copyright (c) 2026, Jeroen D. a.k.a. Magentron

Upstream: https://github.com/antonioribeiro/firewall

All versions of laravel-firewall with dependencies

PHP Build Version
Package Version
Requires php Version ^8.1
illuminate/support Version ^10.0|^11.0|^12.0|^13.0
illuminate/database Version ^10.0|^11.0|^12.0|^13.0
illuminate/http Version ^10.0|^11.0|^12.0|^13.0
illuminate/cache Version ^10.0|^11.0|^12.0|^13.0
illuminate/console Version ^10.0|^11.0|^12.0|^13.0
illuminate/notifications Version ^10.0|^11.0|^12.0|^13.0
illuminate/events Version ^10.0|^11.0|^12.0|^13.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package magentron/laravel-firewall contains the following files

Loading the files please wait ...