IP rules
Allow or block traffic using IP addresses in custom firewall rules.
IP matching in the Easel Firewall uses the client IP address determined by Easel.
Use IP conditions to:
- Restrict internal tools
- Allow trusted services past Attack Mode
- Block abusive networks
- Limit administrative routes
IP matching is configured as a condition on a custom firewall rule. There is no separate IP-list product today.
Single addresses
Examples:
IPv4 and IPv6 addresses are both supported as string values in IP conditions.
Matching operators
For the IP / CIDR condition type:
- Equals / Does not equal compare against the client IP string
- Is any of / Is not any of accept a list of values (one per line)
- String operators such as Starts with or Contains match the textual IP form
Prefer exact equality or list membership over broad substring matches.
Client IP trust
Easel determines the client IP from its trusted edge connection.
Headers such as these are not trusted directly from arbitrary clients:
Easel honors forwarding headers only on its trusted edge path. That same client IP feeds geo and ASN conditions.
Bypass Attack Mode for trusted IPs
To exempt a monitoring service or office network from Attack Mode without disabling platform protections:
Bypass attack challenge skips Attack Mode only. It does not skip platform protections, deployment protection, or other custom rules above this rule in the list.
Deny by IP
Combine IP conditions with path or method conditions when you only need to protect a subset of routes.
Dynamic clients
IP rules are a poor fit for users with frequently changing residential or mobile addresses.
For human access to non-public deployments, prefer Deployment protection with workspace sign-in.
Webhooks
Webhook providers may publish IP ranges, but IP validation alone is often insufficient.
Also verify:
- Request signatures
- Timestamps
- Replay protection
- Expected event types
- Request body integrity