Fix a block by an IP or country rule

Blink has two IP and country rules. The console rule (Instance › Security › IP and country rules) decides where the console can be used from, for everyone including the Owner. Each organization’s agent rule (Organizations › Agent IP rules) decides where that organization’s Access devices may connect from. Support sessions and your customers’ join pages are never restricted. See Restrict access by IP address and country for how the rules work.

Find what you see below.

Sign-in says “Access to the console from this network is not allowed.”

The sign-in, setup or invite page shows Access to the console from this network is not allowed. Your address is outside the console rule. This is not a ban and not a wrong password: Blink refuses every console request from this network before it checks who you are, and the page does not say which addresses are allowed.

1. Connect from an allowed network, for example your company VPN or your office, and try again.
2. If you should be allowed from this network, ask an administrator who can still sign in to add your address or country under Instance › Security › IP and country rules.
3. If nobody can sign in, see Nobody can sign in to the console.

The console shows “Not available from this network”

If the rule changes while you are signed in, or you move to another network, the console shows a full page: Not available from this network, with Your address and Country (Unknown when the address has no country).

• You stay signed in. Connect from an allowed network, such as your company VPN, and click Try again.
• The page also checks again every 30 seconds on its own, and goes away once your address is allowed.
• Sign out ends your sign-in.

Send the address shown to an administrator if it should be allowed.

The viewer or a terminal stops

• The viewer shows Not available from this network and the state blocked by IP rule: The console’s IP rule does not allow this network. It does not keep retrying. Once you are on an allowed network and the console works again, the viewer window starts again by itself.
• A terminal shows Disconnected: the console’s IP rule does not allow this network. The terminal keeps running on the device for 2 minutes. Move to an allowed network quickly: a terminal that no window attaches to for 2 minutes closes.

Saving a console rule closes the live viewers and terminals of everyone outside the new rule at once. The administrator who saved it was warned how many would close.

An Access device shows “blocked by IP rule”

In Access, a device the organization’s agent rule refused shows the status blocked by IP rule. It counts as offline.

1. Hover over the pill. It says where the device connected from, which connection was refused (device connection, Access session or terminal) and when, for example Refused by the agent IP rule from 203.0.113.7 (Germany), device connection, 5 min ago.
2. To list every such device, choose Blocked by IP rule in the status filter. The Offline card shows how many are blocked.
3. Open the device’s details: the IP rule row repeats the refusal. It is cleared when the device next connects from an allowed address.
4. Decide whether the address is expected (the device moved, a new internet line, a VPN). If it is, an administrator with Manage agent IP rules switches to the device’s organization, opens Organizations › Agent IP rules and adds the address or country. Use Test an address against the saved rule with the address from step 1 to check the result.

An Access session or terminal that ends for this reason says The device’s address is not allowed by the organization’s agent IP rule.

The Owner gets the alert Agent blocked by IP rule, at most once per organization per day. See Owner alerts and webhooks.

Enrollment or Install Access is refused

• Enrolling a device with a key from an organization whose agent rule does not allow the computer’s address is refused. The installer exits with code 1 and logs enrollment from this network is not allowed by the organization’s agent IP rule (in C:\ProgramData\Blink\install.log, and in the console it was started from). Add the address or country to that organization’s agent rule, or enroll from an allowed network.
• Install Access in a Support session is refused when the customer’s computer is outside the organization’s agent rule, because the installed device could never connect: The customer’s computer connects from address, which this organization’s agent IP rule does not allow, so Access installed there could not connect. Change the rule first.

A country entry does not match

• Private and local addresses have no country. An address such as 10.0.0.5 or 192.168.1.20, or one the country database does not know, only matches IP range entries. The test then says Refused: the address is not in the rule, and it has no country to match.
• The country may not be where you are. A VPN, a mobile network or a satellite connection can appear in another country. Check what Blink sees: the rule card shows You are connecting from with your address and country.
• IPv4 and IPv6. A browser can reach the console over IPv4 one time and IPv6 the next, and a VPN can use a second network. A rule of IPv4 ranges only refuses your IPv6 address. Add both, or use a country entry, which covers both.

To check any address, an administrator types it in Test an address against the saved rule on the rule’s card and clicks Test. Leave the field empty to test your own address. The answer is Allowed or Refused with the reason, for example Refused: neither the address nor its country is in the rule.

Nobody can sign in to the console

The console refuses to save a rule that does not allow the address of the person saving it, so a full lock-out is rare. It can still happen, for example when your office’s public address changes.

If anyone with Manage security settings can still sign in from an allowed network, they change or remove the rule under Instance › Security › IP and country rules.

On your own server: an administrator on the server host clears the console rule:

docker exec blink blink-server admin ip-rules clear-console -reason "Locked out"

Use your container’s name if it is not blink. The command prints whether the rule was cleared and how many entries it removed. The console can then be used from any address straight away. The clear is recorded in the activity log as Cleared the console IP rule, with your reason, and raises the Owner alert Console IP rule cleared. Sign in and set a new rule that includes your own address.

On Blink Cloud: contact IZT with your Blink address.

An organization’s agent rule never locks you out of the console: an administrator can always change it under Organizations › Agent IP rules.

When to contact IZT

Contact IZT if you use Blink Cloud and nobody can sign in, or if an address is refused although the rule’s test says Allowed. Send your Blink address, the address and country shown, and the time. See Collect logs for IZT support.