Networking & security
Access Control
Learn how to limit access to your services
Use an IP allowlist to restrict connections to TCP or UDP services.
How It Works
When you add one or more allowlist rules to a service, only traffic from the specified IP addresses or subnets is allowed. All other traffic is blocked.
If no rules are configured, the service is open to all traffic (default behavior).
Adding a Rule
- Navigate to your service settings
- Find the Access Control section
- Click Add Rule
- Enter an IP address or CIDR range
- Optionally add a comment to describe the rule (e.g. "Office VPN" or "CI server")
CIDR Notation
Rules use CIDR notation to specify IP ranges, for both IPv4 and IPv6:
| Rule | What it matches |
|---|---|
203.0.113.10 | A single IPv4 address |
203.0.113.0/24 | All IPs from 203.0.113.0 to 203.0.113.255 (256 addresses) |
0.0.0.0/0 | All IPv4 addresses |
2001:db8::1 | A single IPv6 address |
2001:db8::/48 | An IPv6 range |
::/0 | All IPv6 addresses |
Managing Rules
You can update or delete existing rules at any time. Changes take effect shortly after saving.
Access control rules are only available for TCP and UDP services. HTTP services can use other methods like Basic Auth or private networking with NetBird or Twingate to restrict access.
How is this guide?