Manage IP access list

IP access lists allow you to control traffic by allowing or blocking requests based on client IP addresses. This feature is often used to secure staging environments, internal dashboards, or to limit access to trusted networks only.

You can define two types of lists:

• Allowed list - only requests originating from the listed IP addresses are permitted. All others are blocked.
• Blocked list - requests originating from the listed IP addresses are denied. All others are allowed.

Configurationri:link

General behavior

• Lists are disabled by default and cannot be enabled when empty.
• Only one list (Allowed or Blocked) can be enabled at a time.
• You can add entries to a list regardless of whether it is currently enabled or disabled.
• Both IPv4 and IPv6 addresses are supported.
• Changes (adding, removing, enabling, or disabling) may take a few minutes to propagate.

Steps

• Choose the list type you want to use: Allowed or Blocked.
• Add entries to the list: provide IP addresses in IPv4 (192.0.2.1), IPv6 (2001:db8::1), or CIDR range (198.51.100.0/24).
• Enable the list once it contains at least one entry.

Notes

• The Allowed list acts as a whitelist – any IP not on the list will be blocked.
• The Blocked list denies only the listed IPs – all other requests are permitted.
• Be careful not to lock yourself out – always include your own IP when enabling the Allowed list.
• To update an entry, delete it first and then add a new one – editing is not supported.
• To remove the last element from a list, you must disable the list first.

CIDR format

You can add a subnet mask after the IP address using /. If omitted, a /32 is assumed by default, allowing only that single IP. Read more about CIDR format.

Basic Auth & IP allow listri:link

When Basic Auth and the IP access list are enabled simultaneously:

• For addresses on the IP allow list, Basic Auth is not required.

Best practicesri:link

Secure staging or admin environments

• Restrict access to development, testing, or admin panels to specific corporate or VPN IPs.

Combine with Basic Auth for layered security

• Use the IP access list to limit exposure and Basic Auth as an additional protection for users outside your trusted network.

Keep entries up to date

• Review the list regularly and remove obsolete IPs. Rotate addresses if your ISP or VPN provider changes them.

Avoid overly broad ranges

• Restricting by large subnets (e.g., /8) may reduce security and defeat the purpose of an allowlist.

Examplesri:link

Correct usage

• Single IPv4: 203.0.113.42
• Single IPv6: 2001:db8::1
• Corporate subnet (CIDR): 198.51.100.0/24

Incorrect usage

• Empty list (cannot be enabled).
• Invalid format: 203.0.113.999 (out of IPv4 range).