How IP whitelisting works
An administrator adds trusted public IP addresses or CIDR ranges to an access control list. A firewall, reverse proxy or application then compares each connection’s observed source IP with that list.
A rule such as 203.0.113.24/32 approves one IPv4 address, while 203.0.113.0/24 approves the entire 256-address range. If the source doesn’t match, the system may return 403 Forbidden, close the connection or silently drop the traffic.
The check uses the public address visible at the protected system. It doesn’t see a device’s private address behind NAT.
IP whitelisting vs username and password
Both methods can restrict who uses a proxy, but they verify different information.
| IP whitelisting | Username and password | |
|---|---|---|
| Checks | Connecting public IP | Credentials sent by the client |
| Best fit | Stable office or server egress | Clients whose IP may change |
| Common failure | Approved IP changes | Credentials are missing or wrong |
Username and password proxy authentication can identify separate users, while an allowed IP may represent many devices behind one router. An IP blacklist uses the opposite default: it permits addresses unless they appear on the blocked list.
Which proxy IP to whitelist
The correct address depends on where the allowlist is enforced:
- At a proxy service: approve the public IP from which your tool connects. This method works only if the service supports source-IP authentication.
- At a server you control: approve the proxy’s exit IP because that is the address your server sees.
- Behind NAT: remember that every device using the same public egress may appear under one approved address. CGNAT can also make an address shared or subject to change.
- With rotating exits: strict allowlists are usually a poor fit because the visible address changes. A static proxy is easier to approve and maintain.
Safe allowlist setup
- Confirm the public source IP recorded by the receiving firewall or application.
- Approve individual
/32addresses instead of broad ranges where possible. - Pair IP checks with credentials and TLS for sensitive systems. An IP address doesn’t prove which person or process is connecting.
- Log denied connections, review rules regularly and remove entries when a server, office or proxy is retired.
FAQ
What IP should I whitelist when using a proxy?
It depends on the boundary. To access the proxy, whitelist your tool’s public source IP. To access a server you control through the proxy, whitelist the proxy’s exit IP.
Can I whitelist a rotating proxy?
Usually not one address at a time. A rotating proxy changes exit IPs, and approving a provider’s whole range would also admit other customers’ traffic. Use a fixed exit for strict access rules, or require another check such as a password.
Is IP whitelisting secure enough by itself?
No. It limits where connections may originate, but approved networks can contain compromised or unauthorized devices. Use authentication, encryption and access logs alongside the allowlist.