Manage IP Address Lists for eCDN Zones

Create named lists of trusted IP addresses or CIDR ranges to use with custom firewall rules that bypass security checks for trusted traffic on your B2C Commerce storefront.

Note IP access lists are available on SCAPI zones. There's one SCAPI zone for Development, Staging, and Production. Configure it only from the Production instance. It doesn't appear in Business Manager or the CDN API on Development or Staging. A list or rule applied on Production affects all three environments unless you scope it by org ID. See SCAPI Zone Support for B2C Commerce.

Managed IP Address Lists are named collections of IP addresses or CIDR ranges. For how lists are scoped at the account (realm) or zone level and which zone types are eligible, see Realm Security Rules for eCDN Zones. Two list types are supported:

• Allowlist — IP addresses that should bypass security checks. Use with a Custom Firewall Rule with skip actions.
• Blocklist — IP addresses that should be explicitly blocked. Use with a Custom Firewall Rule with a block action.

After creating a list, create a Custom Firewall Rule that references the list and specifies the appropriate action. See Create a Custom Firewall Rule for an eCDN Zone.

Important

Trusted IP Skip behavior is enforced at zone scope. A Cloudflare account-level Skip rule does not bypass zone-level rules. If you add a new zone to your realm, you must ensure the Skip rule exists at the new zone level for the Managed IP List to take effect against zone-level rules on that zone.

Important List names are automatically prefixed with customer_ by the system. You enter only the name portion. The prefix is stripped from display in Business Manager but is required internally. For example, if you enter trusted_ips, the list is stored as customer_trusted_ips.

1. In Business Manager, click the App Launcher, and then select Administration | Sites | Embedded CDN Settings.
2. Locate the zone you want to configure and select Configure Zone from the dropdown menu.
3. Select the Security Rules tab, then select the Realm Security Rules sub-tab.
4. In the Managed IP Address Lists section, click New List.
5. Select the scope for the list.

   Scope	Description
   Account	The list applies to all eligible zones in your realm (Proxy, Legacy, and Default Domain zones).
   Zone	The list applies only to the current zone.

6. Enter a name for the list.

   Follow these naming requirements:

   • Use only lowercase letters, numbers, and underscores.
   • Maximum 41 characters for the name you enter (the system adds a customer_ prefix, making the total stored name 50 characters maximum).
   • Hyphens and spaces are not allowed. Use underscores instead — for example, enter support_team_vpn instead of support-team-vpn.

   The stored name format differs by scope and list type:

   Scope	List type	Stored name format
   Account	Allowlist	customer_name — for example, customer_trusted_ips
   Account	Blocklist	customer_blk_name — for example, customer_blk_blocked_ips
   Zone	Allowlist	customer_zoneID_name — the system automatically prepends the first 8 characters of the zone ID, for example, customer_81d5067d_trusted_ips
   Zone	Blocklist	customer_zoneID_blk_name — for example, customer_81d5067d_blk_blocked_ips

   Zone-level list names are automatically namespaced with the zone ID prefix by the system to prevent naming collisions. Two zones in the same realm can have lists with the same name without conflict.

7. In the IP Addresses field, enter the IP addresses or CIDR ranges to include in the list.

   Enter one record per line. Accepted formats:

   • Single IPv4 address — for example, 198.51.100.1
   • IPv4 CIDR range — for example, 198.51.100.0/24
8. Click Save.
   The list appears in the Managed IP Address Lists section. To use this list to bypass security checks for trusted traffic, create a Custom Firewall Rule that references it. See Create a Custom Firewall Rule for an eCDN Zone.