Administration Guide

How to restrict Site access by IP address

An IP allowlist adds an extra layer of security by limiting access to the current Site to trusted IP addresses and networks. When enabled, the restriction applies both to interactive access by users and API clients and to non-interactive connections from Audit Agents and Audit Services, including the updaters running on the same devices. To prevent unexpected loss of connectivity, you can allow non-interactive clients to connect from addresses outside the allowlist.

Admin Center > Security > Access restrictions

Prerequisites

  • You are signed in as a Site Administrator.
  • You know the addresses or networks from which other users and API clients access the Site.
  • You know the source IP addresses or networks used by Audit Agents and Audit Services, including the updaters running on the same devices, or you have decided to allow these non-interactive clients to connect from outside the allowlist.

IMPORTANT: Plan the allowlist before enabling the restriction. Include every address or network used by users and API clients that require access. If the restriction will also apply to non-interactive clients, include their source addresses. Add the current IP address shown below the allowlist to prevent yourself from being locked out.

Supported entries

Enter one entry per line. The allowlist accepts:

  • individual IPv4 and IPv6 addresses
  • networks in CIDR notation
  • IPv4 address ranges

Lines beginning with # are comments.

For example:

# Office gateway
192.0.2.10
# Corporate subnet
198.51.100.0/24
# VPN address range
203.0.113.20-203.0.113.40

Configure the allowlist

  1. Open Admin Center > Security > Access restrictions.
  2. Enable Restrict access by IP address.
  3. Enter the trusted addresses and networks identified in the prerequisites. Add the current IP address shown below the allowlist.
  4. Review Exempt non-interactive clients from IP restrictions.
  5. Click Save.

If the enabled allowlist is not empty and does not include your current IP address, AlloyScan rejects the change and identifies the address that must be added.

Allow non-interactive clients from outside the allowlist

By default, Exempt non-interactive clients from IP restrictions is cleared when you enable Restrict access by IP address. To allow Audit Agents and Audit Services, along with the updaters running on the same devices, to connect from addresses outside the allowlist, select this option.

NOTE: Although API clients can operate without direct user interaction, AlloyScan treats API access as interactive. API requests remain subject to the allowlist regardless of this option.

IMPORTANT: Before leaving this option cleared, add the source IP addresses or networks of all required non-interactive clients. Clients outside the allowlist will be unable to connect to the Site.

Verify access

  1. Reopen Admin Center > Security > Access restrictions and confirm that Restrict access by IP address is enabled and the allowlist contains the saved entries.
  2. From a device whose IP address is included in the allowlist, sign in to the Site.
  3. If possible, attempt to sign in from an IP address that is not included in the allowlist and confirm that access is denied.
  4. Open Admin Center > Logs > Security log and review the denied access event.
  5. Send a test request from each required API client and confirm that it can connect from an allowed address.
  6. Check recent Last active and Updater last active date values under Admin Center > Tasks and services > Audit agents and Audit services. If the restriction applies to these clients, confirm that all required Audit Agents, Audit Services, and their updaters remain active after saving the allowlist.