Skip to main content

How to let only your own IPs into a tunnel and block others

Since app version 1.3.0

Open the tunnel, its "Security" tab, the "IP addresses" section, turn on "Use IP rules", enter the addresses and click "Save". The rules take effect within 20 seconds. This works for tunnels of any protocol.

Steps​

  1. Under "Tunnels", open the tunnel. It has to be connected: while it connects, the app says "The tunnel is still connecting. You can set up protection once it connects."
  2. Go to the "Security" tab. In the "Tunnel protection" card, pick the "IP addresses" section.
  3. Turn on "Use IP rules".
  4. Under "Allowed addresses", enter an address or a range, for example 203.0.113.7 or 203.0.113.0/24 (a site name won't do), and click "Add". The "Add my address" link adds your current address.
  5. Under "Denied addresses", enter the addresses that must not connect. A deny entry always wins over an allow entry.
  6. Click "Save".

With an empty allow list every address can connect except the denied ones. There can be up to 50 entries.

Shared lists​

The same list of addresses can be attached to several tunnels. Click "Shared lists", then "Manage shared lists…", create a list, and attach it to the tunnel from the same "Shared lists" menu.

Check it​

20 seconds after "Save", connect to the tunnel from an allowed address: it gets through, and an address not on the list doesn't. If you allowed only your own address and can't connect, it may have changed, for example after your provider reconnected you: add the new one with "Add my address" and save.