Ip Acl

Allow or deny requests by source IP/CIDR

Category: Practical
Task: Allow or deny requests by source IP/CIDR

Prerequisites: The product runtime and any backend services referenced by this configuration.

Run it: Use ghcr.io/praxis-proxy/praxis:0.7.2 and follow the first reverse-proxy tutorial to mount and start the configuration.

This configuration comes from the selected release. The example has not been run here; external services are not bundled.

Download the source file.

# IP Access Control List (ACL)
#
# Allow or deny requests by source IP/CIDR. When `allow` is set,
# only matching IPs are permitted (implicit deny-all). Use `deny`
# to block specific IPs while allowing everything else. Both
# IPv4 and IPv6 CIDR ranges are supported. Configuring both
# `allow` and `deny` is rejected as an error.
#
listeners:
  - name: default
    address: "127.0.0.1:8080"
    filter_chains:
      - main

filter_chains:
  - name: main
    filters:
      - filter: ip_acl
        allow:
          # IPv4 loopback
          - "127.0.0.0/8"
          # IPv4 ranges
          - "10.0.0.0/8"
          # IPv6 loopback
          - "::1/128"
          # IPv6 Unique Local Address (ULA) range
          - "fd00::/8"
          # IPv6 documentation prefix (RFC 3849)
          - "2001:db8::/32"

      - filter: router
        routes:
          - path_prefix: "/"
            cluster: backend

      - filter: load_balancer
        clusters:
          - name: backend
            endpoints:
              - "127.0.0.1:3000"

insecure_options:
  allow_private_endpoints: true # example proxies to local backends