Restrict access to trusted IP addresses

Use Edgenivo Firewall to allow requests from trusted IP addresses and deny requests from other networks. Firewall lets you test rules with the Log action, inspect matching traffic, and combine IP addresses with other request conditions. You can manage larger IP allowlists by adding addresses directly to rules or reusable team Lists, then reuse policies across projects.

Create a Project Custom Rule in the project's Firewall settings.

Edgenivo Firewall evaluates the IP address that connects directly to Edgenivo unless Verified Proxy Advanced is configured for an external proxy.

If you don't use Verified Proxy Advanced, allowing an external proxy IP allows every request that reaches Edgenivo through that proxy. Configure end-user access at the external proxy, configure Verified Proxy Advanced, or match a secured forwarding header such as Cloudflare's CF-Connecting-IP when the Firewall rule should evaluate the end-user IP.

Use a Project Custom Rule when one project needs independent control. You can start with a template, enter IP addresses directly, or reference a team List.

The template opens the rule builder with the Log action and an IP Address Is not any of condition. Add your trusted addresses before saving the rule.

Create the rule manually if you need to evaluate a proxy's forwarding header instead of the Firewall IP Address field.

Add Trusted IP Rule

1. Select Add Trusted IP Rule, then choose the project to protect.
2. Add each trusted IP address or CIDR range to the IP Address condition.
3. Add a Domain Environment condition if the rule shouldn't cover all domains.
4. Select Save Rule, review the pending changes, and apply the configuration.
5. Continue with Test and enforce the Firewall rule.

Create the rule manually when you want to reference a team List or add more conditions:

1. From the dashboard, select the project and open Firewall.
2. Select Add New... > Rule.
3. Name the rule, for example Require trusted network.
4. Configure the IP condition using one of these options:
   • To use a team List, select IP Address, Is not in list, and the List.
   • To keep the addresses in this project, select IP Address, Is not any of, and enter each IP address or CIDR range.
   • To evaluate a proxy-provided end-user IP without Verified Proxy Advanced, select Request Header, enter the exact header name set by your proxy (for example, CF-Connecting-IP for Cloudflare), select Is not any of, and enter each allowed IP value exactly as the proxy sends it. Review the forwarded IP header requirements before using this option.
5. Add a Domain Environment condition if the rule shouldn't cover all domains.
6. Set Then to Log.
7. Select Save Rule, review the pending changes, and apply the configuration.
8. Continue with Test and enforce the Firewall rule.

Add a Domain Environment condition to control which domains require a trusted IP address:

The Domain Environment filter uses domain assignments, not the deployment that an alias currently targets. This keeps Standard Protection behavior stable when an alias changes its target.

Test from both an allowed network and a network outside your allowed IP addresses before changing the Firewall action to Deny:

1. Confirm that requests from an allowed IP don't match the Log rule.
2. Confirm that requests from an unlisted IP match the Log rule for every intended domain environment.
3. If you use an external proxy, confirm whether Firewall logs show the proxy IP or the end-user IP expected for your Verified Proxy Advanced configuration.
4. Change the Firewall action to Deny and apply the configuration.
5. Repeat the allowed and unlisted IP tests. Firewall Deny returns 403 Forbidden for an unlisted IP.