> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/object-storage-stook/bucket-configuration/ip-restriction.md).

# IP Restriction

Allow or block access to a Stook Bucket by client IP address.

**IP restriction** controls which IP addresses can access a Stook Bucket. You can either allow access only from specified addresses or block access from specified addresses.

{% hint style="info" %}
IP restriction is not available for every Stook Bucket. If **IP restriction** does not appear on the **Bucket configuration** page, it cannot be configured for that bucket.
{% endhint %}

### How IP Restriction Works

IP restriction provides two modes:

<table><thead><tr><th width="260.4000244140625">Mode</th><th>Effect</th></tr></thead><tbody><tr><td><strong>Allow only listed addresses</strong></td><td>Only requests from the listed addresses or ranges can access the Stook Bucket. All other requests are refused.</td></tr><tr><td><strong>Block listed addresses</strong></td><td>Requests from the listed addresses or ranges are refused. All other requests are allowed.</td></tr></tbody></table>

The restriction applies to:

* Public requests.
* Requests signed with access keys created in the Medianova Control Panel.
* FTP accounts.
* CDN Resources connected to the Stook Bucket.

Requests made with the **master key** are not restricted.

{% hint style="warning" %}
In **Allow only listed addresses** mode, requests from any address that is not on the list are refused. This includes requests from applications using access keys you created, FTP accounts, and CDN Resources connected to the Stook Bucket.

Add every address that requires access before saving the configuration.
{% endhint %}

## Configure IP Addresses

IP restriction supports individual IPv4 addresses and IPv4 ranges in CIDR notation.

* Use an IPv4 address such as `203.0.113.4`.
* Use CIDR notation for a range, such as `198.51.100.0/24`.
* For CIDR ranges, the host portion must be zero. For example, use `10.0.0.0/24` instead of `10.0.0.5/24`.
* IPv6 addresses are not supported.
* Each list can contain up to 100 entries. Use CIDR ranges when multiple addresses can be represented by the same network range.

## Configure IP Restriction

{% stepper %}
{% step %}

### **Open the Stook Bucket**

In the [Medianova Control Panel](https://cloud.medianova.com), select **Stook Object Storage → Buckets**, then select the Stook Bucket.
{% endstep %}

{% step %}

### **Open IP restriction**

On the **Bucket configuration** page, select **IP restriction**.
{% endstep %}

{% step %}

### **Enable IP restriction**

Enable the restriction, then select one of the following modes:

* **Allow only listed addresses**

<figure><img src="https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2FOoXdCAY4mawGVZGAA6mu%2Fimage%20(2).png?alt=media&amp;token=e6a4d3a7-cafe-48cb-8751-b061e77c407e" alt=""><figcaption></figcaption></figure>

* **Block listed addresses**

<figure><img src="https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2FlL4QIQ5njheyjxEutqLK%2Fimage%20(3).png?alt=media&amp;token=68470cc9-7775-4022-b141-a0f4a153a67f" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Add IP addresses**

Add the required IPv4 addresses or CIDR ranges.
{% endstep %}

{% step %}

### **Save the configuration**

Select **Save Changes**.
{% endstep %}
{% endstepper %}

## Configure IP Restriction with the API

Use the bucket settings endpoint to configure IP restriction:

```http
PATCH /api/v2/stook/{organization_uuid}/bucket/{bucket_uuid}/settings
```

### Allow Only Listed Addresses

```json
{
  "is_ip_restriction": true,
  "restriction_type": "deny",
  "ip_list": {
    "allow_ip_list": ["203.0.113.4/32", "198.51.100.0/24"],
    "deny_ip_list": []
  }
}
```

This configuration permits requests from the addresses in `allow_ip_list` and refuses requests from other addresses.

### Block Listed Addresses

```json
{
  "is_ip_restriction": true,
  "restriction_type": "allow",
  "ip_list": {
    "allow_ip_list": [],
    "deny_ip_list": ["192.0.2.10/32"]
  }
}
```

This configuration refuses requests from the addresses in `deny_ip_list` and allows requests from other addresses.

The `restriction_type` value defines what happens to addresses that are not on the configured list:

| `restriction_type` | Mode                        | List used       |
| ------------------ | --------------------------- | --------------- |
| `deny`             | Allow only listed addresses | `allow_ip_list` |
| `allow`            | Block listed addresses      | `deny_ip_list`  |

## Troubleshooting

### **"An IP list may hold at most 100 entries."**

Combine addresses into CIDR ranges to reduce the number of entries.

### **"… has host bits set. Did you mean …?"**

Use the network address of the CIDR range indicated by the validation message.

### **"… IPv6 addresses are not supported by the storage backend."**

Use IPv4 addresses or IPv4 CIDR ranges.

### **"'all' is not an address."**

To allow requests from all addresses, disable IP restriction instead.

### **Requests from my application are refused**

When **Allow only listed addresses** is enabled, the application's public IP address must be included in the list. Verify the public IP address from which the application connects to the Stook Bucket.

## Related Topics

* [Bucket Configuration](/products/object-storage-stook/bucket-configuration.md)
* [Public Access Block](/products/object-storage-stook/bucket-configuration/public-access-block.md)
* [IP Restriction for CDN Resources](/products/security/ip-restriction.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://clients.medianova.com/products/object-storage-stook/bucket-configuration/ip-restriction.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.