How to protect a tunnel with an IP allowlist

IP allowlists are the fastest way to shrink your attack surface. Only traffic from known networks reaches your local server.

Free plan: 1 IP policy (up to 5 CIDR rules). Pro: 10 policies, 50 rules each.

Step 1 — Create the policy

1. Open Dashboard → Security → IP Security.
2. Choose Allow mode (whitelist) or Block mode (blacklist).
3. Add CIDRs, e.g. 203.0.113.10/32 for a single IP or 10.0.0.0/8 for a VPN range.
4. Save and copy the policy ID (ngsrv_ips_…).

Step 2 — Attach to a tunnel

ngsrv http 3000 --policy ngsrv_ips_office

Or in ngsrv.yml:

port: 3000
subdomain: admin
security_policies:
  - ngsrv_ips_office

When to use allow vs block

Common mistakes

• Forgetting your home IP changes — use a /32 and update the policy when your ISP rotates.
• Whitelisting only IPv4 while testers hit you over IPv6 — add both if needed.

More: IP Security docs · Security overview