- Can I use m6web/firewall-bundle in a Laravel application?
- No. m6web/firewall-bundle is a Symfony bundle that relies on Symfony bundle loading, dependency injection extensions, configuration trees, and kernel event listeners, none of which exist in Laravel. You could mine its source for IP-matching logic, but you cannot install and integrate it as designed in a Laravel app. For Laravel, use native middleware and TrustProxies instead.
- How do I install m6web/firewall-bundle?
- You would normally install it with Composer via composer require m6web/firewall-bundle, then register the bundle in a Symfony kernel. In practice, its Symfony framework-bundle and PHP version constraints will usually block installation on Symfony 6/7 and modern PHP runtimes, and Composer will surface an abandoned-package warning. There are zero dependents, so treat any adoption as a private fork from day one.
- How do I configure IP whitelists per path or host?
- The bundle lets you define request-matching rules, including allow lists of IP addresses scoped to paths or hosts, and a customizable deny response for blocked requests. Configuration is handled through the bundle's Symfony dependency-injection extension and configuration tree. If you are reimplementing the idea in Laravel, put equivalent allow/deny logic in a small middleware and keep the rules in config or a database-backed service.
- Which Laravel versions does m6web/firewall-bundle support?
- None. It is a Symfony bundle, not a Laravel package, so there is no service provider, no Laravel middleware, and no tested Laravel version compatibility. Laravel developers should evaluate native options such as TrustProxies, custom middleware, and ThrottleRequests rather than this package.
- Is m6web/firewall-bundle still maintained?
- No. The package has been abandoned since November 2019 and the repository is archived, so there is no security response process and no third-party patches. For a security-sensitive control like IP filtering, an unpatched bypass is a direct exposure. If you need the logic, fork it with a named owner and a security review cadence, or reimplement it natively.
- What is the Laravel alternative to this IP firewall bundle?
- In Laravel, use TrustProxies middleware to resolve the real client IP correctly, a small custom middleware for allow/deny rules, ThrottleRequests for rate limiting, and web-server, ingress, or WAF rules for coarse blocklists. Keep the application layer for fine-grained authorization and push broad IP blocking to the edge. For Symfony, the equivalent is access_control entries with ips: in security.yaml or a thin kernel.request listener using IpUtils::checkIp() and checkIp4().
- Does the firewall work behind a load balancer or CDN?
- Only if the trusted-proxy chain is configured correctly. If X-Forwarded-For is honored without a correctly scoped proxy list, an attacker can spoof the header and bypass the filter, and that failure mode is silent in testing. Also, filter logic attached to kernel.request does not execute when a response is served from Symfony HttpCache or a reverse-proxy cache, so a filter can appear active while doing nothing. Define where traffic terminates and who owns the proxy configuration before relying on application-level IP filtering.
- How should I test IP allow/deny rules?
- Build a fixture matrix covering IPv4, IPv6, IPv4-mapped IPv6 addresses, CIDR boundaries such as /0, proxied requests with and without trusted headers, and responses served from cache. Test both allow and deny outcomes and verify the custom deny response. Because cache-layer bypass and proxy spoofing fail silently, include integration tests that exercise the real request path rather than only unit-testing the rule parser.
- Is it safe to protect admin or staging areas with this bundle?
- It is high risk. The bundle is abandoned, and IP filtering is a security control surface where an unpatched bypass is a direct exposure; trust-boundary mistakes and IPv6/CIDR edge cases can accidentally allow or deny everything. Prefer edge controls such as nginx allow/deny, ingress annotations, or WAF rules for coarse blocking, and keep the application layer for fine-grained authorization. If application-layer IP allowlisting is an audit requirement, use a maintained native implementation with a named owner and security review.
- How do I migrate from m6web/firewall-bundle to native Laravel or Symfony controls?
- Treat the bundle as a specification rather than a dependency. Extract the rule set, including allow lists, deny lists, paths, hosts, ordering semantics, and deny responses, then reimplement it as platform-native configuration or a roughly 50-line listener or middleware. Validate behavioral parity with a fixture matrix covering IPv4, IPv6, CIDR boundaries, proxied requests, and cache-served requests. Where the original intent was coarse blocking, move those rules to the edge and leave the application layer for fine-grained authorization.