---
schema_version: "1"
id: 5201ee251fbf14300838a3867dd5a0a6c438061d79dcc1f407a770648320abb0
title: IP Blocklist Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-ip-blocklist.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-ip-blocklist
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 13e32e1528d0b4c54b3eb71a5ddee867d8f061ff2c55a559c0cee3e189030fdb
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: ip, blocklist, validation, api gateway, flex gateway, gateway, policy
---

# IP Blocklist Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>IP Blocklist</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Blocks a single IP address or a range of IP addresses from accessing an API endpoint</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.0.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/ip-blocklist-release-notes">IP Blocklist</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>403 - IP is rejected</p></td></tr></tbody></table>

## Summary

The IP Blocklist policy controls access to a configured API endpoint from either a single IP address
or a range of IP addresses.

The IP Blocklist policy restricts access to a protected resource when a match is found between a
source IP (specified when configuring the policy) and either a list of individual IPs or a range of
IPs. The policy supports both IPv4 and IPv6 addresses.

DataWeave 2.0 expressions define the source IP to be used when the policy tries to determine whether
the IP belongs to the restricted IP list defined in the policy.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: ip-blocklist-flex config: ips: <array> // REQUIRED ipExpression: <string> //
OPTIONAL, default: "#\[attributes.headers\['x-forwarded-for'\]\]"

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>ips</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The list of IP addresses blocked from the API. You can define one IP or IP range at a time, as many times as required. For more information, see <a href="#specifying_ip_address">Specifying IP Addresses to Blocklist in the Policy</a>.</p></div></div></td></tr><tr><td><div><div><p><code>ipExpression</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>#[attributes.headers['x-forwarded-for']]</code></p></div></div></td><td><div><div><p>The DataWeave 2.0 expression to be used for extracting the IP address from this API request</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: ip-blocklist-flex config: ips: - "192.168.1.1" - "192.168.3.1/30" -
"192.168.2" - "192.160"

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>IP expression</p></div></div></td><td><div><div><p>The DataWeave 2.0 expression used for extracting the IP address from this API request.</p></div></div></td></tr><tr><td><div><div><p>Blocklist</p></div></div></td><td><div><div><p>The list of IP addresses blocked from the API. You can define one IP or IP range at a time, as many times as required. For more information, see <a href="#specifying_ip_address">Specifying IP Addresses to Blocklist in the Policy</a>.</p></div></div></td></tr><tr><td><div><div><p>Method &amp; Resource conditions</p></div></div></td><td><div><div><p>The option to add configurations either to a select few or to all methods and resources of the API.</p></div></div></td></tr></tbody></table>

## Specifying IP Addresses to Blocklist in the Policy

Specify IP addresses to block in your policy based on:

- The IP address of the request.

- The origin IP address that is determined by resolving a specific DataWeave expression, such as the
  [x-Forwarded-For](https://en.wikipedia.org/wiki/X-Forwarded-For) header.

- Any other origin.

### Blocklist Access Based on the IP Address of the Request

Blocklist access based on the IP address of the request in any of the following ways:

- Define a specific IP address by enumerating it in the white space, for example, `192.168.1.1`.

- Define a subset of addresses by identifying a subnet mask, for example, `192.168.3.1/30` includes
  the consolidated range `192.168.3.0` through `192.168.3.3`.

- Define a whole range of IP addresses by specifying the relevant octets of the IP address that you
  want to permit, for example, setting `192.168` will include IP addresses from `192.168.0.0`
  through `192.168.255.255`.

### Blocklist Access Based on the Origin IP Address of the x-Forwarded-For Header

If the client connects to your API through an HTTP proxy or a load balancer, you can blocklist the
client’s specific IP address (the IP address originating the request) instead of the address that
appears in the request

For example, if you want to blocklist `192.168.2.3` and the address of a client connecting through
an HTTP proxy is `92.40.1.255`, the client requests appear with the public address using the proxy.

Typically, applications use the `X-Forwarded-For` header to identify the origin IP addresses of a
request that was redirected to your endpoint.

You can use a DataWeave 2.0 expression in the policy to instruct the service to look for the IP
address in the `x-Forwarded-For` header.

When you insert the IP address in the IP expression field of the policy parameters, Anypoint
Platform is instructed to look for the starting IP address in the concatenated values of the
`x-Forwarded-For` header of the request.