Skip to content
Docs
CtrlK
Go to Dashboard
IP & Subnet Rules

Add office networks to your Allowlist and block malicious network blocks with a simple, safe draft editor

While the single IP blocklist is great for quickly banning a single troublemaker, business websites often need to manage access for entire groups of computers — such as your corporate headquarters, your marketing agency's office, or an entire network of automated spam servers.

IP and Subnet Rules screen displaying CIDR notation input, ALLOW and DENY policy actions, and the Subnet Policy Rules table
Define CIDR-based subnet rules and deploy them to the edge from the IP & Subnet Rules tab.

What are ALLOW and DENY rules?#

  • ALLOW (Trusted Network): Grants VIP access to the specified IP or network range. Visitors from an allowed network bypass Country Geofencing and traffic speed limits. This is ideal for your team's office network, payment provider webhooks (like Stripe or PayPal), and automated website uptime monitoring services.
  • DENY (Blocked Network): Completely blocks any visitor connecting from the specified IP range. They receive an immediate HTTP 403 Forbidden notice reading Request blocked by IP policy.

What is CIDR notation? (A simple guide)#

A CIDR number (like /24 or /32) is simply internet shorthand for specifying how many addresses you are targeting:

  • A single IP address ends in /32 (e.g. 198.51.100.4/32).
  • A typical office building or small neighborhood of addresses ends in /24 (e.g. 198.51.100.0/24, covering 256 addresses).

Step-by-step: how to add a rule#

  1. In Security operations, click the IP & Subnet Rules tab in the sub-navigation bar.
  2. In the Add IP or CIDR Subnet Rule form, enter the IP or range (e.g. 198.51.100.0/24).
  3. Choose the Action: ALLOW (Bypass Limiter & Geoblock) for trusted teams, or DENY (Block with 403) to block.
  4. Choose the Target Scope: Workspace-Wide (Applies to all domains) or a single domain hostname.
  5. In the Note / Justification (Optional) box, add a friendly note (e.g. "Headquarters Office VPN" or "Known Scraper Network").
  6. Click Stage Subnet Rule. The rule appears in the Subnet Policy Rules table below.
  7. When you are ready, click Save Draft and then Deploy changes to activate the rule across all global edge servers.

Expected result#

Clear network rules that keep your trusted staff completely uninterrupted while blocking unwanted network traffic.

Back to IP & Subnet Rules