Protect Access with Allow-Lists

Use basic and endpoint allow-lists to make access to the Proxyble listener default-deny.

An allow-list is a default-deny control for the Proxyble listening port. It is not a firewall for every port on the host; use network firewalls or cloud security controls for broader host and subnet restrictions.

Allow-list entries do not expire and are separate from the manual rules list. Plan access carefully before enabling one so you do not exclude your own administrative or application traffic.

Basic allow-list

Once the first Basic allow-list source is added, the Proxyble listener accepts traffic only from listed IPv4 addresses or CIDR ranges.

sudo proxyble --basic-allow-list --add 203.0.113.25
sudo proxyble --basic-allow-list --add 198.51.100.0/24

To remove a source or disable Basic default-deny by clearing all entries:

sudo proxyble --basic-allow-list --remove 203.0.113.25 --yes
sudo proxyble --basic-allow-list --remove-all --yes

Endpoint allow-list

Endpoint allow-lists are available only in HTTP and HTTPS modes. They apply default-deny to specific request-path prefixes while leaving other paths open.

sudo proxyble --endpoint-allow-list \
  --add 203.0.113.25 \
  --endpoints /login /api

Remove a source from a protected path, or clear all endpoint entries:

sudo proxyble --endpoint-allow-list \
  --remove 203.0.113.25 \
  --endpoints /login \
  --yes

sudo proxyble --endpoint-allow-list --remove-all --yes

When Basic and Endpoint allow-lists are both active, a request must pass both checks. Proxyble stores the managed allow-list state under /etc/proxyble/allow-list/; use the UI or CLI instead of editing those files directly.