IP Access Control

Allow List (Whitelist)

Only allow specific IP addresses:

drip http 3000 --allow-ip 192.168.1.100

Allow multiple IPs (comma-separated):

drip http 3000 --allow-ip 192.168.1.100,192.168.1.101,10.0.0.50

Allow entire network using CIDR notation:

drip http 3000 --allow-ip 192.168.0.0/16

Allow multiple networks:

drip http 3000 --allow-ip 192.168.0.0/16,10.0.0.0/8

Deny List (Blacklist)

Block specific IP addresses:

drip http 3000 --deny-ip 1.2.3.4

Block multiple IPs:

drip http 3000 --deny-ip 1.2.3.4,5.6.7.8

Block entire network:

drip http 3000 --deny-ip 192.168.1.0/24

Combining Allow and Deny

Allow a network but block specific IPs within it:

drip tcp 5432 --allow-ip 192.168.1.0/24 --deny-ip 192.168.1.100

Priority: Deny list is checked first. If an IP matches a deny rule, it's blocked even if it also matches an allow rule.

IPv4 and IPv6 Support

Both IPv4 and IPv6 addresses are supported:

# IPv4
drip http 3000 --allow-ip 192.168.1.0/24

# IPv6
drip http 3000 --allow-ip 2001:db8::/32

Single IPs are automatically converted to /32 (IPv4) or /128 (IPv6).

Access Denied Response

When an IP is blocked:

• HTTP tunnels: Return 403 Forbidden with error message
• TCP tunnels: Close the connection immediately

Private Network Detection

The server automatically detects private network IPs for logging purposes:

• 127.0.0.0/8 (IPv4 loopback)
• 10.0.0.0/8 (RFC 1918 Class A)
• 172.16.0.0/12 (RFC 1918 Class B)
• 192.168.0.0/16 (RFC 1918 Class C)
• ::1/128 (IPv6 loopback)
• fc00::/7 (IPv6 unique local)
• fe80::/10 (IPv6 link-local)

Use Cases