Access Blocks Explained

Four related but distinct ways to control who can reach your organization, all on one Settings screen:

• IP Whitelist — always allowed, and always wins if the same address is also blacklisted.
• IP Blacklist — permanently denied until removed.
• Temporary Block — denied until an expiry you set, then automatically lapses (or you can promote it to a permanent blacklist entry early).
• Geo-Blocking — allow or deny by country rather than by address.

The allow-list flip

Geo-blocking has a behavior worth understanding before you use it: adding a country to the allow list changes the default for every country you haven't listed — instead of "block these specific countries," it becomes "only these countries may connect at all." An empty allow list means the block list is the only thing denying anyone; a non-empty allow list means everything not explicitly allowed is denied.

CIDR ranges

A block entry accepts a single IPv4 address or a CIDR range: no suffix (or /32) is exactly one address, /24 covers 256 addresses, /16 covers 65,536, /8 covers roughly 16 million. IPv6 addresses aren't accepted here.

Related to detection rules

A temporary block can be created two ways: by hand here, or automatically by a detection rule's Auto-Block IP response — see Detection Rules Explained Either way, it shows up in the same Temporary Blocks list.