IP Filter

This module provides support for IP filtering.

Example configuration

The following configuration will allow the 192.168.0.0/24 IPv4 network access, while all other IPv4 and IPv6 networks are rejected. If the client has already authenticated as the consumer admin, only requests from 192.168.0.1/32 are allowed.

{
    "name": "example",
    "host": "example.com",
    "path": "/*",
    "modules": [
        {
            "order": 0,
            "name": "filter-ip",
            "consumers": {
                "admin": {
                    "allow": "192.168.0.1/32"
                }
            },
            "default": {
                "order": "allow,deny",
                "allow": "192.168.0.0/24",
                "deny": "0.0.0.0/0 ::0/0"
            }
        }
    ]
}

Configuration attributes

Attribute	Required	Type	Default	Description
`order`	No	String	`deny,allow`	The order in which allow and deny are considered. Valid values are `allow,deny` and `deny,allow`.
`deny`	No	String		List of networks (in CIDR notation) separated by whitespace that are denied.
`allow`	No	String		List of networks (in CIDR notation) separated by whitespace that are allowed.

All can be configured using 0.0.0.0/0 ::0/0 to specify the entire IPv4 and IPv6 ranges. The first match is used, which is different behavior from httpd mod_access.

Response status

Status	Description
`200`	The client IP is allowed.
`403`	The client IP is denied.

Response headers

Header	Description
`X-IP-Filter`	The outcome of the IP verification. The value is in the format `Deny 192.168.0.1` or `Allow ::1`