restrict-ips

Allows or denies clients by IP address or CIDR range.

Phases	`on_tcp_connecton_http_requeston_http_response`
Terminating	No — the next action runs after it.
Cost	10 Traffic Policy units per run · not on the Free plan

Example

policy.yaml

on_http_request:
  - name: OfficeOnly
    actions:
      - type: restrict-ips
        config:
          allow:
            - 203.0.113.0/24
            - 2001:db8::/32

Start an agent endpoint with it: devgate http 8080 --traffic-policy-file policy.yaml, or paste it into a reserved or cloud endpoint’s Traffic Policy tab in the dashboard.

Configuration

Field	Type	Description
`allow`	list of CIDRs	When set, only clients in these ranges get through.
`deny`	list of CIDRs	Clients in these ranges are refused, even if allow lists them.
`enforce`	boolean	When false, nothing is blocked; useful while testing a list. Default: true.

Behaviour

A refused client gets 403 over HTTP, or a closed connection in on_tcp_connect.
Single addresses work too (198.51.100.7).

Other actions

add-headers remove-headers compress-response basic-auth oauth openid-connect jwt-validation custom-response deny redirect url-rewrite rate-limit circuit-breaker verify-webhook http-request set-vars log close-connection forward-internal

Traffic Policy Phases, rules, expressions and variables. Cloud endpoints Endpoints that are only a policy.