# How to block or allow IP addresses

You can allow or deny specific IP addresses for your applications with a small piece of custom Nginx
configuration. This applies at the web-server level, to the applications of one system user.

> [!NOTE]
> For blocking abusive or malicious traffic, prefer the platform features: [TurboShield](../turboshield/what-is.md)
> (rate limiting and bot control) and the [Firewall](../firewall/what-is.md). Use the Nginx rules
> below for application-level cases, such as locking a site to your office during development.

## Before you start

- **SSH access to the host** - see [SSH access](../../platform/hosts/ssh.md).
- Familiarity with how [custom Nginx configuration](configure.md#custom-nginx-configuration) loads
  from the `~/nginx` directory.

## Allow only certain IPs (deny the rest)

Create a file `~/nginx/10auth.conf` (the low prefix loads it early) and list the allowed addresses:

```nginx
allow 203.0.113.10;    # office VPN
allow 203.0.113.20;
deny all;
```

This protects every application of that system user. It applies only to that user's websites - an
application under a different system user on the same host is not affected.

To protect only part of a site, put the rules inside the relevant `location` block in
`~/nginx/50main.conf` instead - for example `location /` for the whole site, or `location /private/`
for one path:

```nginx
location / {
    try_files $uri $uri/ /index.php$is_args$args;

    allow 203.0.113.10;
    allow 203.0.113.20;
    deny all;
}
```

To allow listed IPs while still serving everyone else (no blocking), combine with `satisfy any` when
you also use authentication - see [Restrict admin access](restrict-admin-access.md).

## Block before Varnish

If Varnish is enabled and you want to block at the edge (before the cache), place the rules in
`~/nginx/outside/main/10whitelist.conf` instead. See
[custom Nginx configuration](configure.md#custom-nginx-configuration).

## Apply and verify

```bash
tscli nginx reload
```

From a blocked address the site returns **403 Forbidden**; from an allowed address it loads normally.

> [!WARNING]
> A wrong rule can lock you (and everyone) out. Keep your own IP in the allow list, and remember
> `tscli nginx reload` reports config errors. If you are unsure, [contact support](../../platform/support.md).

## Related

- [Configure Nginx](configure.md)
- [Restrict admin access](restrict-admin-access.md)
- [TurboShield](../turboshield/what-is.md)
- [Firewall](../firewall/what-is.md)
</content>