Access Blocks Explained
Four related but distinct ways to control who can reach your organization, all on one Settings screen:
- IP Whitelist — always allowed, and always wins if the same address is also blacklisted.
- IP Blacklist — permanently denied until removed.
- Temporary Block — denied until an expiry you set, then automatically lapses (or you can promote it to a permanent blacklist entry early).
- Geo-Blocking — allow or deny by country rather than by address.
The allow-list flip
Geo-blocking has a behavior worth understanding before you use it: adding a country to the allow list changes the default for every country you haven't listed — instead of "block these specific countries," it becomes "only these countries may connect at all." An empty allow list means the block list is the only thing denying anyone; a non-empty allow list means everything not explicitly allowed is denied.
CIDR ranges
A block entry accepts a single IPv4 address or a CIDR range: no suffix (or /32) is exactly one address, /24 covers 256 addresses, /16 covers 65,536, /8 covers roughly 16 million. IPv6 addresses aren't accepted here.
Related to detection rules
A temporary block can be created two ways: by hand here, or automatically by a detection rule's Auto-Block IP response — see Detection Rules Explained Either way, it shows up in the same Temporary Blocks list.
