Restrict endpoints by IP with allowlists

You can restrict who reaches an endpoint by IP address, either as a per-endpoint traffic rule or as a Firewall policy condition.

IP Restriction traffic rule

The per-endpoint IP Restriction rule allows or denies requests from specific IP ranges (IPv4/IPv6 CIDR). It has three fields:

• allow — a list of allowed CIDRs/IPs.
• deny — a list of blocked CIDRs/IPs.
• message — a custom denial message.

Firewall source_ip condition

For ACL-style control, a Firewall policy can match a source_ip condition against an IP address or CIDR (for example 192.168.1.0/24) and Allow or Block accordingly. See Firewall policies and WAF rules.

Allowlisting a stable address upstream

If a partner or upstream firewall needs to allowlist your egress, a dedicated IP gives an endpoint a stable, exclusive ingress address that won’t change.