Opening a Port Only to Certain IP Addresses

If you add allowed source IP addresses to a port forwarding rule, the port can only be reached from these addresses; connections from all other addresses stop at the firewall.

When should it be used?

We recommend allowed sources for ports that not everyone needs to reach, such as remote desktop (3389), SSH (22), databases (3306, 1433, 5432) and admin panels. When these ports are open to the internet, they are constantly targeted by password-guessing attacks.

Adding addresses

• In the Allowed source IP addresses box of the rule form, write one IP address (85.105.10.20) or network (85.105.10.0/24) per line; Enter moves to the next line.
• You can paste a whole list at once; addresses separated by commas or spaces are accepted too. Below the box you immediately see how many addresses will be allowed and any lines with mistakes.
• The Add my current IP button adds the address you are connected to the panel from.
• A rule can have at most 30 addresses or networks. Networks must be between /8 and /32.
• To remove an address, just delete its line.

Adding an address later

Click Edit on the rule's row; the existing addresses appear line by line in the box. Write the new address on a new line and click Save changes.

Adding an address to several rules together

To add the same address to several rules, or remove it from several rules, select the rules and choose Add allowed address or Remove allowed address from the Actions menu. Addresses are not added to rules that are open to everyone (that would restrict the rule), and a rule's only address is not removed (that would open the rule to everyone). Skipped rules are listed after the change.

If you leave it empty

A rule without allowed sources lets anyone on the internet reach the port. You are asked to confirm this before the rule is saved.

Access from your internal network

If access from your internal network (NAT loopback) is on for the rule, servers in your internal network can also reach it; the allowed source list only limits connections from the internet.

Responsibility

You are responsible for the ports you open and the addresses you allow. If you do not have a fixed IP address (home or mobile connection), you need to add the new address to the rule whenever it changes; in that case connecting over VPN may be more convenient.