# Restrict access by IP address and country

IP and country rules decide which networks may reach Blink. There are two kinds:

- **The console rule**, on **Instance** › **Security**, decides where the console can be used from: sign-in, the API and live viewing. When it has entries, it applies to every user, the Owner included.
- **An agent rule** for each organization, on the **Organizations** page, decides where that organization's Access devices may connect from: their connection to the server, Access sessions, terminals and enrollment.

Your customers are never restricted when they join a Support session, and Support sessions are never restricted by an agent rule.

## How a rule works

A rule is a list of entries. Each entry is one of:

- **IP range**: an IPv4 or IPv6 address, or a network written with its prefix length, for example `198.51.100.0/24` or `2001:db8::/48`. A single address counts as its own range.
- **Country**: a country, chosen from the list.

A connection is allowed when its address matches any entry. A rule with no entries restricts nothing, so every address is allowed.

- A rule holds at most 100 entries.
- Each entry can carry a **Note** of up to 200 characters, such as the office or VPN it belongs to.
- Private and local addresses (such as `10.0.0.0/8`, `192.168.0.0/16` or `127.0.0.1`) have no country, and neither has an address the country data doesn't know. They only match **IP range** entries.

## Who can see and change the rules

| Rule | To see it | To change it |
|---|---|---|
| Console rule | **View security settings** | **Manage security settings** |
| Agent rule of an organization | **View agent IP rules** | **Manage agent IP rules** |

The starter **Admin** role includes both agent IP rule permissions. See [Roles and permissions](/configure/roles/).

Saving a rule is a high-risk action, so Blink may ask you to confirm with a passkey or code. See [Confirming high-risk actions](/configure/security-settings/#confirming-high-risk-actions).

## Set the console rule

1. Open **Instance** › **Security** and find the **IP and country rules** card, below **Sign-in**.
2. Check the line **You are connecting from**: it shows your current address and its country. Select **Add my address** to add it as an entry, with the note **Added from my address**.
3. To add another entry, choose **IP range** or **Country**:
   - For an IP range, enter the **Address or network**, for example `198.51.100.0/24`.
   - For a country, pick it under **Country**.
4. Optionally enter a **Note**, such as `Office VPN`, and select **Add**.
5. Repeat for each network your team works from. To take an entry out, select the cross (**Remove**) at the end of its row. You can change a note in the **Note** column at any time.
6. Read the line under the list, which tells you what saving does (see below), then select **Save rule**. **Discard** throws away your unsaved edits.

The pill in the card's header shows how many entries the saved rule has, or **Not restricted** when it has none. Under the buttons, **Changed** shows when the rule was last saved and by whom. Changes apply at once.

While you type an address, Blink checks it:

- **The prefix length must be 0 to 32.** (or 128 for IPv6) means the number after the `/` is out of range.
- **This range covers a large part of the internet.** is a warning only: the range is very wide, so it restricts little.

When you select **Add**, **That entry is already in the rule.** means the entry is listed already.

:::tip[Add your fallback first]
Before you narrow the rule to your office, add your company VPN or a second office as well. If one of them is down, the others still let you in.
:::

### Lock-out protection

Blink won't save a console rule that would shut you out. If the entries don't allow the address you are connecting from, the card shows **This rule would lock you out.** with your address, and **Save rule** stays off until you add it, or an entry that covers it.

Blink only sees the address of your current connection. If your rule only has IPv4 entries (or only IPv6 entries), the card warns that your browser may reach the console over the other kind of address, or through a second network such as a VPN, next time. Add that address too.

If your team is shut out anyway, for example because your office's address changed, see [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/).

### Live connections closed on save

A new rule applies to connections that are already open, not only new ones. After each edit, the card checks what saving would do:

- **No live connection would close.**
- **Saving closes** followed by what would close, for example "2 live viewers and 1 terminal", **outside the new rule.**

A console rule closes live viewers and terminals opened from addresses outside it. When something would close, saving asks **Close live connections?** and you confirm with **Save and close them**. If the check failed, saving asks **Save without a preview?** instead, because it may close any live connection outside the rule; select **Save anyway** to go ahead.

## Set an organization's agent rule

1. Switch to the organization with the organization switcher. The card does not show while **All organizations** is selected.
2. Open **Organizations**. The **Agent IP rules** card is below the **Current organization** panel.
3. Add, edit and save entries as for the console rule: **IP range** or **Country**, **Note**, **Add**, then **Save rule**.

The agent rule has no lock-out check, because it never affects your own console. Saving it closes that organization's device connections, Access sessions and Access terminals that come from addresses outside the rule, after the same **Close live connections?** confirmation.

A device outside the rule shows **blocked by IP rule** in the device list. See [Manage Access devices](/use/manage-devices/).

## Test an address

Both cards let you check an address against the saved rule, before or after you change it:

1. Under **Test an address against the saved rule**, enter an IP address. Leave it empty to test your own address.
2. Select **Test**.

The result shows **Allowed** or **Refused**, the address and its country, and the reason, for example:

- **Allowed: matches 198.51.100.0/24.**
- **Allowed: the rule is empty, so it restricts nothing.**
- **Refused: neither the address nor its country is in the rule.**
- **Refused: the address is not in the rule, and it has no country to match.**

The test checks the saved rule, not your unsaved edits.

## Remove or delete a rule

To lift a restriction, remove every entry. The card then says **No entries: saving removes the restriction.** Select **Save rule**, and Blink shows **Rule removed**. An empty rule closes nothing.

If your [plan](/configure/plans-and-limits/#when-something-is-not-in-your-plan) doesn't include IP and country rules, the card shows **Not included in your plan: IP and country rules**. Entries that are already saved stay enforced, and you can't change them, but you can still remove the whole rule with **Delete rule**. Blink asks **Delete the console rule?** or **Delete the agent rule?** first.

## Warnings on the card

- **The stored rule cannot be read.** Blink can't read the saved rule, so it refuses every address the rule covers until it is replaced. Save a new rule, or an empty one; **Save rule** works here even without an edit. If this keeps happening, contact [IZT](https://izt.app).
- **The country database is not loaded.** **Country** entries match nothing until it is. **IP range** entries still apply. Contact [IZT](https://izt.app) if this stays.

## IP rules, the allowlist and bans

The **Security** page also has an **Allowlist** and **Bans**. They do different jobs:

- The **IP and country rules** decide who may use the console, or connect a device, at all.
- The **Allowlist** only exempts trusted networks from rate limits and bans. An allowlisted address outside the console rule is still refused.
- **Bans** refuse addresses that failed too often, or that you banned yourself, for a while.

See [Security settings](/configure/security-settings/).

## What blocked people and devices see

- On the sign-in page: **Access to the console from this network is not allowed.**
- A signed-in user moved to a network outside the console rule sees **Not available from this network**, with their address and country. They stay signed in, and the page checks again every 30 seconds.
- A viewer shows **blocked by IP rule** and does not reconnect. A terminal disconnects, and keeps running on the device for 2 minutes.
- An Access device outside its organization's agent rule shows **blocked by IP rule** in the device list.

For each of these, and for getting back in, see [Fix a block by an IP or country rule](/troubleshooting/blocked-by-ip-rule/).

## Alerts and activity

- When an organization's Access device is refused by its agent rule, instance owners get the alert **Agent blocked by IP rule**, at most once per organization per day. Refusals by the console rule are not alerted. See [Owner alerts and webhooks](/configure/alerts/).
- The activity log records **Changed the console IP rule** and **Changed the agent IP rule**, **Cleared the console IP rule** when the console rule was cleared outside the console to get a team back in, and **Refused by an IP rule** for refused connections. Refusals are grouped by address and hour, with a count, so a busy address doesn't flood the log.

## Country data

Countries come from a country database that ships with your Blink server and is updated with each server release. The line at the bottom of each card shows its date, for example **Country database of November 2026**, and the credit **IP geolocation by DB-IP (https://db-ip.com), CC BY 4.0.**

A country match is only as good as the address data. A VPN, a mobile network or a cloud provider may appear in a different country from the one the person is in. When in doubt, use **IP range** entries for your own networks, and test them.