CIDR restrictions
Restrict runtime identities to known source IP networks as an additional security layer.
CIDR restrictions limit where a runtime credential may be used. They are available for ingest clients, query clients, and API-key policies where supported.
CIDR examples
| Value | Meaning |
|---|---|
192.0.2.15/32 | One IPv4 address |
198.51.100.0/24 | An IPv4 network |
2001:db8::15/128 | One IPv6 address |
2001:db8:1234::/48 | An IPv6 network |
Configure safely
Add the real public egress addresses seen by ReportPlane, not an application's private container or LAN address. Include every legitimate egress path before enforcing the policy.
An empty allowed_ips or allowed-CIDR list means no IP restriction. It is not interpreted as deny-all.
Use CIDR as a layer
Source addresses can change and network location alone is not a strong application identity. Combine CIDR with a token, API key, JWT, or mTLS certificate.
Syslog behavior
Syslog routing by a generated destination IPv6 still applies configured CIDR checks. On shared IPv4 listeners, expected-hostname and CIDR matching can also participate in client resolution when destination identity is unavailable.
Troubleshooting
If a valid credential is unexpectedly forbidden, inspect the source IP observed by the client detail/statistics surfaces. Check NAT gateways, egress proxies, dual-stack behavior, and failover addresses.