OneTaskBy Tim King · Updated
IP Allowlist Builder
IP Whitelist Rules for nginx, iptables and Cloudflare WAF, With Optional Ports
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the IP Allowlist Builder works
This IP allowlist builder turns a list of addresses into working allow or block rules for your server or firewall. Paste IPs, ranges or CIDR blocks, pick nginx, Apache, iptables, nftables, ufw or Cloudflare, and copy rules that only let trusted addresses reach an admin panel, API or SSH port.
What the IP allowlist builder produces
Addresses are cleaned up first. Ranges written with a hyphen are converted to CIDR, duplicates are removed and anything that is not a valid IPv4 or IPv6 address is reported, so a typo cannot silently open or close access.
In allow mode the rules let the listed addresses in and refuse everyone else. For iptables and nftables the builder also keeps loopback traffic and replies to existing connections, because a bare deny-all would cut off your own server and any SSH session you are using. In block mode the listed addresses are refused and everything else is left alone.
Ports narrow the rules to specific services, for example 22 for SSH or 8443 for an admin panel. Web server formats apply to the site or location you paste them into instead, so ports are ignored there.
Test firewall rules from a second session before logging out. A wrong allowlist on the SSH port is the most common way to lock yourself out of a server.
FAQ
Should I use an allowlist or a blocklist?
An allowlist is far stronger when the set of legitimate users is small and known, such as office IPs for an admin page. Blocklists only stop addresses you already know about, and attackers change addresses easily, so treat them as a short-term fix.
What happens if my home IP address changes?
You will be refused like anyone else. Home connections often get a new address after a router restart. Use a VPN or a small cloud server with a fixed IP as the allowed address, and keep console access to the server as a way back in.
Where do the nginx rules go?
Put them inside the server or location block you want to protect, then run nginx -t and reload. Rules in a location block only apply to that path, which is useful for protecting just /admin while leaving the rest of the site public.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
IP Range To CIDR Converter
Turn start and end IP addresses into the fewest CIDR blocks.
Firewall Rule Explainer
Explain iptables and ufw rules in plain English and flag risky ones.
Port Number Lookup
See what runs on a port and whether exposing it is risky.
IP Subnet Calculator
Network, broadcast, host range and counts for any subnet.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.