> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slipway.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Inbound IP rules

> Restrict which IP addresses can reach a service.

You can restrict a service to a list of allowed IPv4 addresses or CIDR ranges. Anything
not on the list is turned away at the edge before it reaches your container — blocked
HTTP requests get a `403` (and still appear in your request logs), and blocked database
connections are refused at the external endpoint.

Rules are set per service, and the restriction follows the list: adding the first range
restricts the service to it, and deleting the last one (and saving) opens the service to
every IP again — there is no separate on/off switch. In `slipway.yaml`, an explicitly
**empty** `ipRules: []` block remains the spelled-out lock-out: it blocks all inbound
traffic until the block is removed or ranges are added.

Inbound IP rules for web services and static sites are available on paid plans (see
[Plans](/plans)). Rules on a database's external endpoint are available on every plan.

## Where they apply

| Service | Enforced at |
| - | - |
| Web service with a public port | The edge, on the service's public URL — platform and custom domains alike. |
| Static site | The CDN edge, before any file is served. |
| Database with [external access](/data/postgres#connect-from-outside-the-cluster) | The external endpoint gateway, per connection. |

Traffic between services inside a project is never filtered — rules apply only to
inbound traffic from the internet. Workers and cron jobs receive no inbound traffic, so
they cannot carry rules.

## Setting rules

**Console**

Open the service, then **Networking**, and add the ranges you want to allow. A rule
is an IPv4 address (`203.0.113.42`) or CIDR range (`203.0.113.0/24`), with an
optional description. Changes apply to the running service immediately with no
redeploy — an edit is enforced on the very next request.

**slipway.yaml**

Add an `ipRules:` list to the service:

```yaml slipway.yaml theme={"system"}
version: 1

services:
  - name: admin
    rootDir: ./admin
    ports:
      - port: 3000
        public: true
    ipRules:
      - cidr: 203.0.113.0/24
        description: Office
      - cidr: 198.51.100.7
        description: VPN egress
```

A service's **Networking** tab overrides the block for that project. Once you
change it in the console, the console value wins on every deploy — including
removing a spec-declared restriction.

Rules are IPv4 only, up to 50 per service. A bare address is shorthand for a `/32`
range, and `0.0.0.0/0` allows everything (useful to keep a descriptive list around
while temporarily opening the service).

## Interaction with other features

* **Auth**: IP rules run before the sign-in wall. A blocked IP gets a `403` and never
  sees the sign-in page.
* **Previews**: a PR preview of the service inherits its rules, like auth.
* **Sleep**: a blocked request cannot wake a sleeping service.
* **Plan changes**: downgrading locks the editor but never strips live rules — a
  restricted service stays restricted, and you can always loosen or remove rules.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.