Traffic control
IP lists and bans
Allowlists, blocklists, and temporary or permanent bans.
Goal
Control access by client IP using lists and ban actions.
Prerequisites
iplists.read/iplists.write.- Understand
DataPlane:UseForwardedHeaders(default true) when behind another proxy.
Steps — static lists
- Open Security → IP lists.
- Add allow or block entries (CIDR supported in list config).
- Set expiry or permanent as needed.
- Save.
Runtime order
IpFilter runs before rate limiting:
- Allow list can bypass block/ban checks for matching clients.
- Block list or active ban → 403.
Bans from policies
WAF actions:
TemporaryBan— e.g.{ "durationSeconds": 300 }PermanentBan
Stored in Redis (sg:t:{tenantId}:ban:{ip}) when Redis is enabled.
Verify
- Blocked IP receives 403.
- Allowed IP can access even if also present on a block path you intend to override (per allow semantics).
Pitfalls
- Misconfigured forwarded headers can ban the edge proxy IP instead of clients.
- Local ban store is per-node without Redis.