IP filtering
IP filtering restricts access to the system by client IP address at the company level. It is configured on the Settings → Security screen by an Administrator (for their own company) or a Super administrator (for any company, selected with the company selector above the lists).
The screen is not available with the Basic license or without a license: opening it shows a license notification and returns you to the start page.
How the check works
The address is checked on every sign-in, after the password has been verified but before the session is opened. The same check applies to requests authenticated with an API key.
- The blacklist is checked first. If the address is on it, access is denied regardless of the whitelist
- Then the whitelist is checked. While it is enabled, access is allowed only from addresses explicitly listed in it
- Entries with the Excluded status are ignored by the check, so a rule can be switched off temporarily without deleting it
- A user rejected by the lists sees "Access denied for your IP address. Contact administrator for details" on the sign-in page
- For signed-in users the address is checked again when the application is opened and whenever the company's lists change. The session ends only when the check confirms that the address is not allowed; if the check itself fails, for example because of a network error, the user stays signed in
The lists
The screen has two tabs, IP whitelist and IP blacklist, with an identical table:
| Column | Description |
|---|---|
| IP address | The address, with the subnet mask appended when one is specified |
| Description | Free-text description of the entry |
| Status | Active or Excluded |
| Actions | Editing, excluding or activating, and deleting the entry |
All three data columns support sorting and a filter; Status is filtered with a dropdown. When nothing matches, the table shows "No addresses found".
Turning a list on and off
Each tab has a switch next to the Add IP address button; its hint reports the current state, for example "IP whitelisting enabled" or "IP blacklisting disabled".
Turning a list on asks for confirmation:
| List | Confirmation |
|---|---|
| Whitelist | "Are you sure you want to enable the IP whitelist? Users connecting from IP addresses not on the list will lose access to the system" |
| Blacklist | "Are you sure you want to enable the IP blacklist? Users connecting from IP addresses on the list will lose access to the system" |
Turning a list off is applied immediately, without a confirmation.
Limitation: a list needs at least one active address to work. Enabling an empty list, or excluding or deleting the last active entry of an enabled list, is blocked with the message "IP whitelist requires at least one active IP address to function" (and the equivalent message for the blacklist).
Adding and editing an entry
The Add IP address button and the edit action open the Add IP address / Edit IP address dialog:
| Field | Requirements |
|---|---|
| IP address | Required. An IPv4 address, optionally with a CIDR mask from 0 to 32, for example 192.168.1.0/24. An incorrect value is reported as "Invalid IP format" |
| Description | Optional, up to 255 characters |
On the whitelist tab the address field also has an Insert my IP address button that fills in the address you are currently connecting from. If the address cannot be determined, the message "IP address is not defined. Please select your IP address using other services and insert it manually" appears.
Save stays disabled until the form is valid.
Excluding and deleting entries
Excluding an active entry asks for confirmation, with a text that depends on the list:
- Whitelist: "Are you sure you want to exclude this IP address from the IP whitelist? Users connecting from this address may lose access to the system"
- Blacklist: "Are you sure you want to disable this IP address from the IP blacklist? This may allow attackers from this address to gain access to the system"
Activating an excluded entry is applied without a confirmation. Deleting asks for confirmation with a similar warning about losing access, or about opening access from the address in the case of the blacklist.
All operations on the lists — enabling and disabling filtering, adding, editing, activating, excluding and deleting entries — are recorded in the audit log.