Guide
Limit a tunnel by IP address
Allow only the networks you list, or block the networks you list, for one tunnel.
- Applies to
- Starter and higher; durable tunnels
- Time
- About 5 minutes
- What it changes
- Changes who can reach the tunnel by network address. It applies within 30 seconds.
- Last reviewed
- , by Product documentation
Before you begin
What to know before you start
- An allow list refuses everyone who is not on it, including you, if you open the address from a network you did not list.
- A visitor who is refused sees a fixed page that says the tunnel does not accept requests from their network.
Steps
Step 1. Open the tunnel in the dashboard and find IP access.
You should see: You see Who may visit with its options.
Step 2. Choose Only these networks, or Everyone except these networks.
You should see: A box appears for the addresses.
Step 3. Enter one address or network per line, then save.
IP access 203.0.113.10 198.51.100.0/24 2001:db8::/32Use single addresses or networks in CIDR form, IPv4 or IPv6. A list holds up to 50 entries.
You should see: The dashboard says the IP list is saved and that it applies within 30 seconds.
To check: Open the address from a network that is not on an allow list. You see the refusal page.
You are done when
- A request from a listed network is answered and a request from another network is refused.
Undo or clean up
- Set Who may visit back to Everyone and save.
Related
This page is part of Share and protect. Still stuck? Contact support.