Skip to main content

Overview

The IP Access Control feature allows you to define and manage which traffic can access the assets behind your Proxy. This is an essential security measure for controlling access to your applications and services.

What is IP Access Control?​

IP Access Control enables users to create rules that determine whether traffic from specific sources is allowed or blocked. Rules can be based on five distinct criteria:

  • IP Address: A specific IPv4 or IPv6 address
  • CIDR range: A block of IP addresses (e.g., 192.168.1.0/24)
  • Known Service: Traffic originating from third-party providers pre-verified by us (read more here)
  • ASN (Autonomous System Number): A collection of IP networks managed by a single network operator or ISP
  • Country: Traffic originating from specific geographic locations

Rule Evaluation Order​

When a request hits your proxy, rules are evaluated in a strict, top-down order. Once a match is found, subsequent rules are ignored.

Rules are processed from most specific to least specific:

  1. IP Address
  2. CIDR range (Note: More specific CIDR ranges like /24 are evaluated before less specific ranges like /16)
  3. Known Service
  4. ASN
  5. Country

Understanding Rule Actions​

When creating a rule, the rule action determines how matching traffic is processed:

  • Allow: Permits the traffic to pass through the IP Access Control layer and proceed to subsequent security modules
  • Block: Immediately drops the request and denies access to the proxy.

Bypassing Bot Protection​

When setting a rule to Allow, you can optionally enable Bypass Bot Protection.

This permits the traffic and exempts it from Bot Protection challenges. It is ideal for cases where you want to guarantee legitimate traffic isn't accidentally challenged or blocked by the Bot Protection.

Note: This option is exclusively available when using IP Address, CIDR range, or Known Service source types combined with an Allow action.