ip-restriction

Allows or denies connections by client IP address or CIDR range.

Category SecurityAdd it to Stream routeEngine plugin ip-restrictionPriority 3000

What it does

ip-restriction lets a connection go on to the stream route's backend or refuses it by the client's address. With Allow these addresses every address outside Whitelist is refused, with Deny these addresses every address on Blacklist.

A refused connection is closed. Unlike the HTTP plugin of the same name, it has no status code and no message to set.

When to use it

• A database port that only the network of your application servers, 10.0.0.0/8 for example, may open.
• MQTT brokers that accept devices from your internal networks only, 10.0.0.0/8 and 192.168.0.0/16.
• A network that misuses a port, for example 203.0.113.0/24, kept out with Deny these addresses while every other address connects.
• An IPv6 network kept out by its prefix, for example 2001:db8::/32.

Not for refusing HTTP requests by address on a route — see ip-restriction (Allows or denies clients by IP address or CIDR range) or capping how many connections one address keeps open — see limit-conn (Limits concurrent connections per key).

Set it up

Accept connections from the internal networks only

Choose Allow these addresses and fill Whitelist as in the JSON below.

ip-restriction · as the console saves it

{
  "whitelist": [
    "10.0.0.0/8",
    "192.168.0.0/16"
  ]
}

More scenarios

Refuse connections from one network while accepting every other

Choose Deny these addresses and fill Blacklist as in the JSON below.

ip-restriction · as the console saves it

{
  "blacklist": [
    "203.0.113.0/24"
  ]
}

Things to know

• Whitelist — A connection from an address outside the list is closed: with 10.0.0.0/8 and 192.168.0.0/16 listed, a client of neither network is not let through.
• Blacklist — A connection from an address on the list is closed.
• Whitelist — An entry is one address, 10.0.0.1 for example, or a network written with its prefix length, 10.0.0.0/8. An entry that is neither, 10.0.0.0/33 for example, is refused when you save.
• The two lists do not go together: a plugin that carries both is refused when you save.
• The response_code the HTTP plugin carries does not exist here: a response_code of 404 is refused when you save.
• AdviceFor a client whose address is not fixed, a device on a mobile network for example, a list of networks is no lock.

Settings

The fields as the console shows them, section by section.

Choose one:

• Allow these addressesEvery address outside the list is refused.
• Deny these addressesEvery address on the list is refused.

Allow these addresses

Whitelistwhitelistarray of stringsRequired

at least 1 item

Deny these addresses

Blacklistblacklistarray of stringsRequired

at least 1 item

Every plugin also has Enabled, Priority, Filter, Error response and Pre-function: see Plugin execution settings.