Module ip_allow 

The allowed_ip check: which networks may talk to the server.

The bluntest and most reliable control available: it needs no DNS, no external service, and cannot be influenced by the client. On a CA serving one LAN it is usually the only check needed — and the one worth having whether or not challenge.bypass is set.

Allow and deny

Two lists, with the same semantics the reverse_dns and identifiers checks use: deny is checked first and wins, and an empty allow imposes no constraint. That gives three usable shapes —

• allow only: a strict allowlist.
• deny only: a blocklist, everything else served.
• both: an allowlist with holes punched in it, e.g. allow = ["10.0.0.0/8"] and deny = ["10.1.2.0/24"].

Deny-wins is plain set membership, not longest-prefix-match: a /32 in allow does not beat a /8 in deny. That matches the other two checks, and the surprising direction is the safe one.

Both stages

This check reads nothing but the client address, which IdentifierContext carries as well as ConnectionContext, so it decides at either stage. That is not a detail: it is what lets a rule say mgmt-net or inventory and have the address half remain answerable at the point where the inventory is consulted.

Structs

AllowedFromIpAddress

Accepts or refuses a request by the network its client address falls in.

Settings

Resolved [filter.check.<name>] settings for type = "allowed_ip".