Help Center/ Web Application Firewall/ FAQs/ Protection Rules/ How Do I Allow Only Specified IP Addresses to Access Protected Websites?
Updated on 2025-10-21 GMT+08:00
View PDF
Share

How Do I Allow Only Specified IP Addresses to Access Protected Websites?

After you add the website to WAF, configure blacklist and whitelist rules or precise protection rules to allow only specified IP addresses to access the website. WAF then blocks all source IP addresses except the specified ones.

Configuring IP Address Blacklist and Whitelist Rules to Block All Source IP Addresses Except the Specified Ones

  1. Log in to the WAF console.
  2. Click in the upper left corner and select a region or project.
  3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
  4. In the navigation pane on the left, click Policies.
  5. Click the name of the target policy to go to the protection rule configuration page.

    Before configuring protection rules, ensure that the target protection policy has been applied to a domain name. A protection policy can be applied to multiple protected domain names, but a protected domain name can have only one protection policy.

  6. In the Blacklist and Whitelist configuration area, enable the protection.
  7. In the upper left corner of the Blacklist and Whitelist page, click Add Rule.
  8. In the Add Blacklist or Whitelist Rule dialog box, add two blacklist rules to block all source IP addresses. Figure 1 and Figure 2 show two examples.

    Figure 1 Blocking IP address range 1.0.0.0/1
    Figure 2 Blocking IP address range 128.0.0.0/1

  9. Click Add Rule. In the displayed Add Blacklist or Whitelist Rule dialog box, add a rule for the specified IP address or IP address range.

    For example, if you want to allow XXX.XX.2.3 to access your website, add a protection rule as shown in Figure 3.
    Figure 3 Allowing the access of a specified IP address

Configuring a Precise Protection Rule to Block All Source IP Addresses Except the Specified Ones

  1. Log in to the WAF console.
  2. Click in the upper left corner and select a region or project.
  3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
  4. In the navigation pane on the left, click Policies.
  5. Click the name of the target policy to go to the protection rule configuration page.

    Before configuring protection rules, ensure that the target protection policy has been applied to a domain name. A protection policy can be applied to multiple protected domain names, but a protected domain name can have only one protection policy.

  6. In the Precise Protection configuration area, enable the protection.

    Figure 4 Precise Protection configuration area

  7. In the upper left corner of the displayed page, click Add Rule.
  8. In the displayed Add Precise Protection Rule dialog box, add a protection rule as shown in Figure 5 to block all requests.

    The priority value here must be greater than that configured in Step 9 because allowing access has a higher priority than blocking access and a smaller priority value indicates a higher priority.

    Figure 5 Blocking all requests

  9. Click Add Rule. In the displayed Add Precise Protection Rule dialog box, add a rule for the specified IP address.

    For example, if you want to allow 192.168.2.3 to access the website, add a protection rule as shown in Figure 6.

    The priority value here must be smaller than that configured in Step 8 because allowing access has a higher priority than blocking access and a smaller priority value indicates a higher priority.

    Figure 6 Allowing the access of a specified IP address

    You can also add a whitelist rule for specified IP addresses or IP address range by referring to Step 9.

Parent topic: Protection Rules