Access control

1. Zones & Access, Access lists, add one.
2. Put your office ranges under Allowed, one per line.
3. Set When nothing matches to deny.
4. Tick Include the management networks so you do not lock yourself out.
5. Choose the list on the /admin path rather than on the whole site.

Make an access list with When nothing matches set to allow, and put the address under Blocked. That is a public area with exceptions, which is the opposite shape to a private area.

Turn on Ask for a username and password on the access list, or the equivalent switch on the site. Reasonable as a second layer on top of an address check. Thin on its own: it is one shared secret, it is often written down, and it never gets rotated.

Almost always one of three things.

• Your real address is IPv6 and the list only names IPv4. Put both forms in.
• Your office address changed.
• You did not tick Include the management networks.

Fix it from a node with a shell, or from an address that is on the list, then apply.

Only when something trustworthy sits in front of your load balancers, such as a CDN, and you have named it as trusted. If you turn it on with nothing trustworthy in front, anybody can set that header themselves and walk straight through your access list.

There is no partial version of this. Either the header is trustworthy or your list is decoration.

Settings, Management networks. One CIDR per line. Anything that ticks Include the management networks picks them up, along with every cluster node from the roster.

This is not the same as the list that controls who can reach the GUI. That one lives in the environment file on each node, because it has to be in force before the login page renders.