How to whitelist an IP address

Permanently trust a known-good IP address (office, monitoring, integrations) on your TurboStack host so it is never rate-limited or blocked.

Add an IP address to the allow-list to trust it permanently. Trusted clients bypass rate-limiting and blocking, and are never caught by the automatic protection that blocks repeated failed logins. Use it for addresses you control - your office, a monitoring service, or a partner integration.

Warning

An allow-listed client skips the firewall's protections. Only add addresses you genuinely trust, and keep the list as narrow as possible.

Before you start

The exact address or range to trust. A single address (198.51.100.7) or the tightest range that covers it.
Access to the host's Security tab for a lasting entry, or SSH access for an immediate one.

Add a trusted IP on the Security tab (recommended)

For lasting trust, add the address to the host configuration so it stays across deployments:

Open the host and go to the Security tab.
Under Whitelist IP Addresses, add the IP address, or the tightest range that covers it.
Save and publish.

This writes the firewall_whitelist key for you - see Configure the firewall.

Whitelist immediately with the CLI

To trust an address right away - for example to restore access for someone who is locked out - connect over SSH:

tscli firewall whitelist 198.51.100.7

For a change that must last, also add it on the Security tab as above.

Remove from the allow-list

tscli firewall unlist 198.51.100.7

If you added the address on the Security tab, remove it there and publish.

Apply and verify

An entry made on the Security tab is active once the publish has finished; a CLI entry is active as soon as the command returns. tscli firewall display-whitelists lists the address, and a client on it is no longer rate-limited or blocked.

If it did not work

If the address is still blocked, the publish may not have run yet - check History. A manual block from tscli firewall block also wins: tscli firewall check <ip> shows it and tscli firewall unblock <ip> removes it. A client that still gets 403 is refused by the web server, not the firewall - see Fixing 403, 413 and 429 errors, or contact support.