Filtering traffic to your application

Overview

By default, all traffic is allowed to visit your web servers on ports 80, 443, 8080 and 8443. Traffic filtering caters for five exceptions to this:

1. Explicitly allowing only certain IP addresses (whitelisting)
2. Explicitly allowing traffic only from certain countries
3. Explicitly denying certain IP addresses (blacklisting)
4. Explicitly denying traffic from certain countries (blacklisting)
5. Forcing traffic to flow via your load balancer(s) rather than hitting servers directly

Cloud 66 also automatically rate limits IP addresses and will temporarily block an address that hits your application too often. Please read our Application Surge Protection guide for more details.

Configuring Traffic Filters

To configure traffic filters for your application:

Allowing traffic (whitelisting)

Whitelisting is useful in cases where you need to lock down an application completely and only allow access for a specific IP (or range of IPs) or from specific countries.

To whitelist a list of IP addresses or IP address ranges, navigate to the Traffic Filters page (see above for instructions) and then add the IP address or range to the Only allow traffic from these sources field. Then click Review changes and then Apply changes.

IP addresses and ranges can be entered as comma separated lists. For example:

23.213.76.19
23.213.76.1/16
23.213.76.19,31.152.18.22,197.222.132.0/24

You can also add lists of addresses via URLs. The URL must point to either a txt or JSON formatted document. See our reference guide for more details.

Allowing traffic by country

To whitelist a country or set of countries, navigate to the Traffic Filters page (see above for instructions) and then select (or search) for the countries you wish to white list in the Only allow traffic from these Countries field. Then click Review changes and then Apply changes.

Denying traffic (blacklisting)

You can also blacklist specific IPs and/or ranges from visiting the ports mentioned above. To do so, navigate to the Traffic Filters page (see above for instructions) and then add the IP address or range to the Block traffic from these sources field. Then click Review changes and then Apply changes.

You can test this by adding your own IP address to the Deny list and then trying to visit your application in the browser. If you've configured this correctly you will get a 403 Forbidden error from your app's Nginx proxy.

As above, you can enter IP addresses in comma separated lists, as ranges, or a combination. You can also add lists of addresses via URLs. The URL must point to either a txt or JSON formatted document. See our reference guide for more details.

Denying traffic by country

Works identically to whitelisting by countries above, except that it uses the Block traffic from these Countries field.