---
schema_version: "1"
id: 776a6c4bdfd5bc85efebe7df81c18985f560a458669cea747c5d08d7518717ae
title: IP Allowlist Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.9/policies-included-ip-allowlist.md
canonical_url: https://docs.mulesoft.com/gateway/1.9/policies-included-ip-allowlist
source_site: docs.mulesoft.com
content_type: documentation
content_hash: f5cc19b898dfe94789e7d240d338bea63dfa5388dc9a5bc0c99358be7ba54c30
description: MuleSoft Documentation Site
release: "1.9"
latest: false
---
---
product: Omni Gateway
version: 1.9
keywords: ip, allowlist, validation, api gateway, flex gateway, gateway, policy
---

# IP Allowlist Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>IP Allowlist</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Allows a list or range of specified IP addresses to request access</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Flex Gateway version available</strong></p></td><td><p>v1.0.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>403 - IP is rejected</p></td></tr></tbody></table>

## Summary

The IP Allowlist policy allows a list or a range of specified IP addresses access to a protected
resource when a match is found between a source IP (specified when configuring the policy) and a
list of individual IPs or range of IPs. The policy supports both IPv4 and IPv6 addresses.

DataWeave 2.0 expressions define the source IP used by the policy to determine whether the IP
belongs to the policy’s restricted IP list.

## Configuring Policy Parameters

### Flex Gateway Local Mode

In Local Mode, you apply the policy to your API via declarative configuration files. Refer to the
following policy definition and table of parameters:

\- policyRef: name: ip-allowlist-flex config: ips: <array> // REQUIRED ipExpression: <string> //
OPTIONAL, default: "#\[attributes.headers\['x-forwarded-for'\]\]"

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>ips</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The list of IP addresses allowed access to the API. You can define one IP or IP range at a time, as many times as required. For more information, see <a href="#specifying_ip_address">Specifying IP Addresses to Allowlist in Your Policy</a>.</p></div></div></td></tr><tr><td><div><div><p><code>ipExpression</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>#[attributes.headers['x-forwarded-for']]</code></p></div></div></td><td><div><div><p>The DataWeave 2.0 expression to be used for extracting the IP address from this API request</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: ip-allowlist-flex config: ips: - "192.168.1.1" - "192.168.3.1/30" -
"192.168.2" - "192.160"

### Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy to your API instance from the UI, the following parameters are displayed:

<table><colgroup><col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>IP expression</p></div></div></td><td><div><div><p>The DataWeave 2.0 used for extracting the IP address from this API request.</p></div></div></td></tr><tr><td><div><div><p>Allowlist</p></div></div></td><td><div><div><p>The list of IP addresses allowed access to the API. You can define one IP or IP range at a time, as many times as required. For more information, see <a href="#specifying_ip_address">Specifying IP Addresses to Allowlist in Your Policy</a>.</p></div></div></td></tr><tr><td><div><div><p>Method &amp; Resource conditions</p></div></div></td><td><div><div><p>The option to add configurations either to a select few or to all methods and resources of the API.</p></div></div></td></tr></tbody></table>

## Specifying IP Addresses to Allowlist in Your Policy

Specify IP addresses to allow access to your policy based on:

- The IP address of the request

- The origin IP address that is determined by resolving a specific DataWeave expression, such as the
  [x-Forwarded-For](https://en.wikipedia.org/wiki/X-Forwarded-For) header

- Any other origin.

### Allowlisting Access Based on the IP address of the Request

Allowlist access based on the IP address of the request in any of the following ways:

- Define a specific IP address by enumerating it in the Allowlist field, for example, `192.168.1.1`.

- Define a subset of addresses by identifying a subnet mask, for example, `192.168.3.1/30`, which
  includes the consolidated range `192.168.3.01` through `192.168.3.3`.

- Define a whole range of IP addresses by stating the relevant octets of the IP address you want to
  permit, for example, setting `192.168`, which includes IP addresses from `192.168.0.0` through
  `192.168.255.255`.

### Allowlisting Access Based on the Origin IP Address of the x-Forwarded-For Header

If the client connects to your API through an HTTP proxy or a load balancer, you can allowlist the
client’s specific IP address (the IP address originating the request) instead of the address that
appears in the request.

For example, if you want to allowlist `192.168.2.3`(private IP) and the address of a client
connecting through an HTTP proxy is `92.40.1.255` (public IP), the client requests appear with the
public address using the proxy.

Typically, applications use the `X-Forwarded-For` header to identify the origin IP addresses of a
request that was redirected to your endpoint.

You can use a DataWeave 2.0 expression in the policy to instruct the service to look for the IP
address in the `x-Forwarded-For` header.

When you insert the IP address in the IP expression field of the policy parameters, Anypoint
Platform is instructed to look for the starting IP address in the concatenated values of the
`x-Forwarded-For` header of the request.