IP Restriction

Allow or block access to a Stook Bucket by client IP address.

IP restriction controls which IP addresses can access a Stook Bucket. You can either allow access only from specified addresses or block access from specified addresses.

IP restriction is not available for every Stook Bucket. If IP restriction does not appear on the Bucket configuration page, it cannot be configured for that bucket.

How IP Restriction Works

IP restriction provides two modes:

Mode	Effect
Allow only listed addresses	Only requests from the listed addresses or ranges can access the Stook Bucket. All other requests are refused.
Block listed addresses	Requests from the listed addresses or ranges are refused. All other requests are allowed.

The restriction applies to:

• Public requests.

• Requests signed with access keys created in the Medianova Control Panel.

• FTP accounts.

• CDN Resources connected to the Stook Bucket.

Requests made with the master key are not restricted.

In Allow only listed addresses mode, requests from any address that is not on the list are refused. This includes requests from applications using access keys you created, FTP accounts, and CDN Resources connected to the Stook Bucket.

Add every address that requires access before saving the configuration.

Configure IP Addresses

IP restriction supports individual IPv4 addresses and IPv4 ranges in CIDR notation.

• Use an IPv4 address such as 203.0.113.4.

• Use CIDR notation for a range, such as 198.51.100.0/24.

• For CIDR ranges, the host portion must be zero. For example, use 10.0.0.0/24 instead of 10.0.0.5/24.

• IPv6 addresses are not supported.

• Each list can contain up to 100 entries. Use CIDR ranges when multiple addresses can be represented by the same network range.

Configure IP Restriction

1

Open the Stook Bucket

In the Medianova Control Panel, select Stook Object Storage → Buckets, then select the Stook Bucket.

2

Open IP restriction

On the Bucket configuration page, select IP restriction.

3

Enable IP restriction

Enable the restriction, then select one of the following modes:

• Allow only listed addresses

• Block listed addresses

4

Add IP addresses

Add the required IPv4 addresses or CIDR ranges.

5

Save the configuration

Select Save Changes.

Configure IP Restriction with the API

Use the bucket settings endpoint to configure IP restriction:

PATCH /api/v2/stook/{organization_uuid}/bucket/{bucket_uuid}/settings

Allow Only Listed Addresses

{
  "is_ip_restriction": true,
  "restriction_type": "deny",
  "ip_list": {
    "allow_ip_list": ["203.0.113.4/32", "198.51.100.0/24"],
    "deny_ip_list": []
  }
}

This configuration permits requests from the addresses in allow_ip_list and refuses requests from other addresses.

Block Listed Addresses

{
  "is_ip_restriction": true,
  "restriction_type": "allow",
  "ip_list": {
    "allow_ip_list": [],
    "deny_ip_list": ["192.0.2.10/32"]
  }
}

This configuration refuses requests from the addresses in deny_ip_list and allows requests from other addresses.

The restriction_type value defines what happens to addresses that are not on the configured list:

restriction_type	Mode	List used
deny	Allow only listed addresses	allow_ip_list
allow	Block listed addresses	deny_ip_list

Troubleshooting

"An IP list may hold at most 100 entries."

Combine addresses into CIDR ranges to reduce the number of entries.

"… has host bits set. Did you mean …?"

Use the network address of the CIDR range indicated by the validation message.

"… IPv6 addresses are not supported by the storage backend."

Use IPv4 addresses or IPv4 CIDR ranges.

"'all' is not an address."

To allow requests from all addresses, disable IP restriction instead.

Requests from my application are refused

When Allow only listed addresses is enabled, the application's public IP address must be included in the list. Verify the public IP address from which the application connects to the Stook Bucket.

Related Topics

• Bucket Configuration

• Public Access Block

• IP Restriction for CDN Resources