ShieldGate Docs

Traffic control

IP lists and bans

Allowlists, blocklists, and temporary or permanent bans.

Goal

Control access by client IP using lists and ban actions.

Prerequisites

  • iplists.read / iplists.write.
  • Understand DataPlane:UseForwardedHeaders (default true) when behind another proxy.

Steps — static lists

  1. Open Security → IP lists.
  2. Add allow or block entries (CIDR supported in list config).
  3. Set expiry or permanent as needed.
  4. Save.

Runtime order

IpFilter runs before rate limiting:

  • Allow list can bypass block/ban checks for matching clients.
  • Block list or active ban → 403.

Bans from policies

WAF actions:

  • TemporaryBan — e.g. { "durationSeconds": 300 }
  • PermanentBan

Stored in Redis (sg:t:{tenantId}:ban:{ip}) when Redis is enabled.

Verify

  • Blocked IP receives 403.
  • Allowed IP can access even if also present on a block path you intend to override (per allow semantics).

Pitfalls

  • Misconfigured forwarded headers can ban the edge proxy IP instead of clients.
  • Local ban store is per-node without Redis.