How to block or allow IP addresses

Allow or deny specific IP addresses for your application at the web-server level on TurboStack.

You can allow or deny specific IP addresses for your applications with a small piece of custom Nginx configuration. This applies at the web-server level, to the applications of one system user.

Note

For blocking abusive or malicious traffic, prefer the platform features: TurboShield (rate limiting and bot control) and the Firewall. Use the Nginx rules below for application-level cases, such as locking a site to your office during development.

Before you start

SSH access to the host - see SSH access.
Familiarity with how custom Nginx configuration loads from the ~/nginx directory.

Allow only certain IPs (deny the rest)

Create a file ~/nginx/10auth.conf (the low prefix loads it early) and list the allowed addresses:

allow 203.0.113.10;    # office VPN
allow 203.0.113.20;
deny all;

This protects every application of that system user. It applies only to that user's websites - an application under a different system user on the same host is not affected.

To protect only part of a site, put the rules inside the relevant location block in ~/nginx/50main.conf instead - for example location / for the whole site, or location /private/ for one path:

location / {
    try_files $uri $uri/ /index.php$is_args$args;

    allow 203.0.113.10;
    allow 203.0.113.20;
    deny all;
}

To allow listed IPs while still serving everyone else (no blocking), combine with satisfy any when you also use authentication - see Restrict admin access.

Block before Varnish

If Varnish is enabled and you want to block at the edge (before the cache), place the rules in ~/nginx/outside/main/10whitelist.conf instead. See custom Nginx configuration.

Apply and verify

tscli nginx reload

From a blocked address the site returns 403 Forbidden; from an allowed address it loads normally.

Warning

A wrong rule can lock you (and everyone) out. Keep your own IP in the allow list, and remember tscli nginx reload reports config errors. If you are unsure, contact support.