IP Allowlist

Restrict proxy access to specific IP addresses.

The IP allowlist restricts which source IP addresses can connect to a proxy. When the allowlist is non-empty, any connection from an IP not matching an entry is rejected before authentication runs.

When to Use

Use the IP allowlist when your agents run from a known IP range — a VPN, a static egress IP, or a specific cloud region. Combining an allowlist with proxy credentials gives you two independent layers of access control.

CIDR Format

Entries are IPv4 CIDR ranges. Both host addresses and subnet ranges are valid:

203.0.113.45 — a single IP (no prefix; CIFP treats this as /32 internally)
203.0.113.0/24 — a /24 subnet
10.0.0.0/8 — all private 10.x.x.x addresses

Managing the Allowlist

bash

# List current entries
curl https://cifp.vril.dev/api/proxies/proxy-id/ip-allowlist \
  -H "Authorization: Bearer cifp_your_api_key"

# Add an entry
curl -X POST https://cifp.vril.dev/api/proxies/proxy-id/ip-allowlist \
  -H "Authorization: Bearer cifp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"cidr": "203.0.113.0/24", "description": "Office network"}'

# Remove an entry by entry ID
curl -X DELETE https://cifp.vril.dev/api/proxies/proxy-id/ip-allowlist \
  -H "Authorization: Bearer cifp_your_api_key" \
  -d '{"entryId": "uuid-of-the-entry"}'

Empty Allowlist

When the allowlist is empty, CIFP allows connections from any IP (subject to proxy credential authentication). Adding the first entry immediately restricts access.

Lock-out risk

Adding an entry locks out all IPs not in the allowlist, including your own if you're not careful. Always add your own IP or CIDR before adding restrictive entries.

Sync Behaviour

Changes to the allowlist are pushed to the proxy's auth database immediately via the internal API. There is no proxy restart required. The change takes effect on the next connection attempt.