Restrict access by IP address and country

IP and country rules decide which networks may reach Blink. There are two kinds:

• The console rule, on Instance › Security, decides where the console can be used from: sign-in, the API and live viewing. When it has entries, it applies to every user, the Owner included.
• An agent rule for each organization, on the Organizations page, decides where that organization’s Access devices may connect from: their connection to the server, Access sessions, terminals and enrollment.

Your customers are never restricted when they join a Support session, and Support sessions are never restricted by an agent rule.

How a rule works

A rule is a list of entries. Each entry is one of:

• IP range: an IPv4 or IPv6 address, or a network written with its prefix length, for example 198.51.100.0/24 or 2001:db8::/48. A single address counts as its own range.
• Country: a country, chosen from the list.

A connection is allowed when its address matches any entry. A rule with no entries restricts nothing, so every address is allowed.

• A rule holds at most 100 entries.
• Each entry can carry a Note of up to 200 characters, such as the office or VPN it belongs to.
• Private and local addresses (such as 10.0.0.0/8, 192.168.0.0/16 or 127.0.0.1) have no country, and neither has an address the country data doesn’t know. They only match IP range entries.

Who can see and change the rules

Rule	To see it	To change it
Console rule	View security settings	Manage security settings
Agent rule of an organization	View agent IP rules	Manage agent IP rules

The starter Admin role includes both agent IP rule permissions. See Roles and permissions.

Saving a rule is a high-risk action, so Blink may ask you to confirm with a passkey or code. See Confirming high-risk actions.

Set the console rule

1. Open Instance › Security and find the IP and country rules card, below Sign-in.
2. Check the line You are connecting from: it shows your current address and its country. Select Add my address to add it as an entry, with the note Added from my address.
3. To add another entry, choose IP range or Country:
   • For an IP range, enter the Address or network, for example 198.51.100.0/24.
   • For a country, pick it under Country.
4. Optionally enter a Note, such as Office VPN, and select Add.
5. Repeat for each network your team works from. To take an entry out, select the cross (Remove) at the end of its row. You can change a note in the Note column at any time.
6. Read the line under the list, which tells you what saving does (see below), then select Save rule. Discard throws away your unsaved edits.

The pill in the card’s header shows how many entries the saved rule has, or Not restricted when it has none. Under the buttons, Changed shows when the rule was last saved and by whom. Changes apply at once.

While you type an address, Blink checks it:

• The prefix length must be 0 to 32. (or 128 for IPv6) means the number after the / is out of range.
• This range covers a large part of the internet. is a warning only: the range is very wide, so it restricts little.

When you select Add, That entry is already in the rule. means the entry is listed already.

Add your fallback first

Before you narrow the rule to your office, add your company VPN or a second office as well. If one of them is down, the others still let you in.

Lock-out protection

Blink won’t save a console rule that would shut you out. If the entries don’t allow the address you are connecting from, the card shows This rule would lock you out. with your address, and Save rule stays off until you add it, or an entry that covers it.

Blink only sees the address of your current connection. If your rule only has IPv4 entries (or only IPv6 entries), the card warns that your browser may reach the console over the other kind of address, or through a second network such as a VPN, next time. Add that address too.

If your team is shut out anyway, for example because your office’s address changed, see Fix a block by an IP or country rule.

Live connections closed on save

A new rule applies to connections that are already open, not only new ones. After each edit, the card checks what saving would do:

• No live connection would close.
• Saving closes followed by what would close, for example “2 live viewers and 1 terminal”, outside the new rule.

A console rule closes live viewers and terminals opened from addresses outside it. When something would close, saving asks Close live connections? and you confirm with Save and close them. If the check failed, saving asks Save without a preview? instead, because it may close any live connection outside the rule; select Save anyway to go ahead.

Set an organization’s agent rule

1. Switch to the organization with the organization switcher. The card does not show while All organizations is selected.
2. Open Organizations. The Agent IP rules card is below the Current organization panel.
3. Add, edit and save entries as for the console rule: IP range or Country, Note, Add, then Save rule.

The agent rule has no lock-out check, because it never affects your own console. Saving it closes that organization’s device connections, Access sessions and Access terminals that come from addresses outside the rule, after the same Close live connections? confirmation.

A device outside the rule shows blocked by IP rule in the device list. See Manage Access devices.

Test an address

Both cards let you check an address against the saved rule, before or after you change it:

1. Under Test an address against the saved rule, enter an IP address. Leave it empty to test your own address.
2. Select Test.

The result shows Allowed or Refused, the address and its country, and the reason, for example:

• Allowed: matches 198.51.100.0/24.
• Allowed: the rule is empty, so it restricts nothing.
• Refused: neither the address nor its country is in the rule.
• Refused: the address is not in the rule, and it has no country to match.

The test checks the saved rule, not your unsaved edits.

Remove or delete a rule

To lift a restriction, remove every entry. The card then says No entries: saving removes the restriction. Select Save rule, and Blink shows Rule removed. An empty rule closes nothing.

If your plan doesn’t include IP and country rules, the card shows Not included in your plan: IP and country rules. Entries that are already saved stay enforced, and you can’t change them, but you can still remove the whole rule with Delete rule. Blink asks Delete the console rule? or Delete the agent rule? first.

Warnings on the card

• The stored rule cannot be read. Blink can’t read the saved rule, so it refuses every address the rule covers until it is replaced. Save a new rule, or an empty one; Save rule works here even without an edit. If this keeps happening, contact IZT.
• The country database is not loaded. Country entries match nothing until it is. IP range entries still apply. Contact IZT if this stays.

IP rules, the allowlist and bans

The Security page also has an Allowlist and Bans. They do different jobs:

• The IP and country rules decide who may use the console, or connect a device, at all.
• The Allowlist only exempts trusted networks from rate limits and bans. An allowlisted address outside the console rule is still refused.
• Bans refuse addresses that failed too often, or that you banned yourself, for a while.

See Security settings.

What blocked people and devices see

• On the sign-in page: Access to the console from this network is not allowed.
• A signed-in user moved to a network outside the console rule sees Not available from this network, with their address and country. They stay signed in, and the page checks again every 30 seconds.
• A viewer shows blocked by IP rule and does not reconnect. A terminal disconnects, and keeps running on the device for 2 minutes.
• An Access device outside its organization’s agent rule shows blocked by IP rule in the device list.

For each of these, and for getting back in, see Fix a block by an IP or country rule.

Alerts and activity

• When an organization’s Access device is refused by its agent rule, instance owners get the alert Agent blocked by IP rule, at most once per organization per day. Refusals by the console rule are not alerted. See Owner alerts and webhooks.
• The activity log records Changed the console IP rule and Changed the agent IP rule, Cleared the console IP rule when the console rule was cleared outside the console to get a team back in, and Refused by an IP rule for refused connections. Refusals are grouped by address and hour, with a count, so a busy address doesn’t flood the log.

Country data

Countries come from a country database that ships with your Blink server and is updated with each server release. The line at the bottom of each card shows its date, for example Country database of November 2026, and the credit IP geolocation by DB-IP (https://db-ip.com), CC BY 4.0.

A country match is only as good as the address data. A VPN, a mobile network or a cloud provider may appear in a different country from the one the person is in. When in doubt, use IP range entries for your own networks, and test them.