Inbound IP rules

Available

What it does

Restrict which client IPs can reach a service's public URL. Rules are stored per service and enforced in the Isoward gateway before traffic is proxied to the container.

Modes

Allow all (default) — no IP restriction.
Allowlist — only listed IPv4 addresses/CIDRs may connect.
Denylist — listed IPv4 addresses/CIDRs are blocked; everyone else is allowed.

How to configure

Open the service → Settings → Inbound IP, or call PUT /v1/services/:id/ip-rules with { "mode": "allowlist", "cidrs": ["203.0.113.0/24"] }.

Behind Cloudflare, the gateway prefers CF-Connecting-IP, then X-Forwarded-For. IPv6 CIDRs are not supported yet.