Block an address at the layer that actually receives the connection. Use ordered allow/deny rules in NGINX, Require ip in Apache HTTP Server 2.4, IP Address and Domain Restrictions in IIS, or a host/network firewall when the connection should be stopped before the web server sees it. First confirm the client IP visible at that layer, then choose a denylist or allowlist, include IPv6 where applicable, validate the configuration, and keep a tested recovery path.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the enforcement layer before writing a rule
The same IP policy behaves differently depending on where it is enforced. A web-server rule can protect one site, virtual host, URL, or proxied service. A host or perimeter firewall applies to the machine or interface and can reject traffic before HTTP processing.
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Layer | Scope | Best fit | Main operational risk |
|---|---|---|---|
| NGINX HTTP | Server, location, or site handled by NGINX | Blocking or allowing web clients and selected URL paths | Rule order and an incorrect perceived client address can produce the opposite result |
| NGINX stream | Proxied TCP services in a stream server block |
Restricting non-HTTP TCP resources before proxying | A broad rule can cut off an entire TCP service |
| Apache HTTP Server 2.4 | Apache configuration contexts that support authorization rules | Current Apache 2.4 access control using addresses or networks | Using deprecated compatibility directives makes future upgrades harder |
| IIS | Sites, applications, or the IIS server through IP Address and Domain Restrictions | Windows web servers managed in IIS Manager or configuration | A default-deny list can lock out administrators, including local access if loopback is omitted |
| Host or network firewall | Whole host, interface, port, or upstream perimeter | Stopping unwanted connections before the web service processes them | It affects every service sharing the address or port, not just one URL |
U.S. government firewall guidance describes TCP/IP packet filtering with host tools such as iptables and recommends limiting the public interface to expected web ports. That is the appropriate boundary when the requirement is “do not let this source establish a connection,” rather than “let the connection reach the server but deny a particular path.”
Prepare the policy safely
Find the real client IP
Inspect the address recorded at the component where the rule will run. A CDN, reverse proxy, or load balancer may terminate the client connection and open a new one to your server. In that arrangement, NGINX, Apache, IIS, or the firewall may see the proxy address rather than the visitor. IIS supports optional inspection of X-Forwarded-For, but only use a forwarded header when the proxy that supplies it is trusted and its source is constrained. Otherwise a client can spoof the header, or your rule can block the proxy and affect every visitor behind it.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Verify the path with proxy logs, web-server access logs, and a controlled request from a known address. Document which hop is authoritative before adding an allowlist.
Choose a denylist or an allowlist
- Denylist: permit normal traffic and reject selected addresses or networks. It is practical when the set of unwanted sources changes frequently.
- Allowlist: permit only named addresses or ranges and reject everything else. It suits an administration site, private application, staging server, or service used by fixed office and VPN ranges.
An allowlist is safer only when you know every required source. Home and mobile addresses can change, and a forgotten IPv6 range can create an apparent bypass or an administrator lockout.
Account for both IP versions
If the hostname has an AAAA record or the listener is dual-stack, write an IPv6 policy as well as an IPv4 policy. A rule that names only an IPv4 address does not govern a client that connects over IPv6.
Keep a recovery path
Before enabling a broad default deny, keep an out-of-band console, cloud serial console, or provider recovery route. Preserve an approved management range and test it from the same network administrators will use. A local browser session can also require the loopback address to remain permitted on IIS.
Block addresses in NGINX HTTP
The official ngx_http_access_module “allows limiting access to certain client addresses.” Its allow and deny directives accept an individual address, a CIDR network, unix:, or all. NGINX evaluates the rules in sequence and stops at the first match.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Block one address while leaving other clients allowed
server {
listen 443 ssl;
server_name example.test;
deny 203.0.113.44;
allow all;
}The specific deny is encountered before the catch-all allow, so that address receives a denial while other addresses remain eligible. A CIDR block works the same way:
deny 203.0.113.0/24;Use an IPv6 address or CIDR when the unwanted source connects over IPv6, for example:
deny 2001:db8:1234::/48;Create an allowlist
Put each approved network first and the default deny last:
server {
listen 443 ssl;
server_name admin.example.test;
allow 192.168.1.0/24;
allow 198.51.100.27;
allow 2001:db8:44::/48;
deny all;
}Only the listed IPv4 and IPv6 ranges match an allow; every other address reaches deny all. If a particular address must be excluded from an otherwise approved range, place its specific deny before the broader allow, because first match wins.
Apply and verify the change
- Save the change in the relevant
httpconfiguration,serverblock, orlocationblock. - Run the installation’s configuration test, commonly
nginx -t. Do not reload if syntax validation fails. - Reload NGINX through the service manager used by the host, such as the system’s normal reload operation.
- Test from an approved address and from a blocked address. Check the status code and the access/error logs to confirm that the request reached the intended rule.
Keep the rule at the narrowest scope that meets the requirement. A location-level restriction protects one path; a server-level restriction protects every location in that virtual server.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Restrict proxied TCP services with NGINX stream
In a stream server block, NGINX also supports allow and deny for proxied TCP resources by address or range. The processing order is still top to bottom. This configuration is wrong for an allowlist because the first line matches everyone:
stream {
server {
listen 3306;
deny all;
allow 198.51.100.27;
}
}Place the exception first:
stream {
server {
listen 3306;
allow 198.51.100.27;
deny all;
proxy_pass database_backend;
}
}Validate and reload using the same controlled process as the HTTP configuration, then test the TCP service from both an approved and an unapproved network. Because stream rules affect the proxied resource rather than an individual URL, check that the selected port is not shared by another service.
Use Apache HTTP Server 2.4 authorization rules
For current Apache HTTP Server 2.4 configurations, use Require ip. It accepts a full IPv4 or IPv6 address, a partial IPv4 address, a network/netmask pair, or CIDR such as 192.168.1.0/24. Apache documents the older Allow, Deny, and Order directives from mod_access_compat as deprecated; avoid them in new guidance.
Allow only named addresses or networks
<Directory /var/www/private>
Require ip 192.168.1.0/24
Require ip 198.51.100.27
Require ip 2001:db8:44::/48
</Directory>Use the equivalent authorization context supported by your deployment, such as a virtual-host or directory section. Multiple Require ip lines in the same authorization provider are useful for listing approved sources. Confirm that the section applies to the site or path you intend rather than every hosted site.
Exclude a source while otherwise allowing clients
Combine a general grant with a negative address requirement:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
<Directory /var/www/site>
<RequireAll>
Require all granted
Require not ip 203.0.113.44
</RequireAll>
</Directory>For a network exclusion, replace the address with a CIDR range. Test the resulting authorization, because Apache’s combination containers determine how positive and negative requirements are evaluated.
Apply the Apache change
- Edit the active virtual-host, directory, or other permitted configuration context.
- Run the configuration checker used by the installation, commonly
apachectl configtestor the distribution’s equivalent. - Reload Apache through its normal service manager only after the check reports valid syntax.
- Request the protected URL from an approved and a blocked source, and inspect the access and error logs.
Block addresses in IIS
IIS exposes the feature through IP Address and Domain Restrictions. To deny one address in IIS Manager:
- Select the server, site, or application in IIS Manager.
- Open IP Address and Domain Restrictions.
- Choose Add Deny Entry.
- Enter the individual IP address, or use the feature’s network restriction option where a range is required.
- Apply the change and test the affected site.
IIS rules support ordered entries and an allowUnlisted setting. Setting allowUnlisted to false creates a default-deny posture: unlisted addresses cannot access the protected scope. The corresponding configuration uses XML attributes, for example:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
<ipSecurity allowUnlisted="false">
<add ipAddress="198.51.100.27" allowed="true" />
<add ipAddress="2001:db8:44::/48" allowed="true" />
</ipSecurity>Use the exact schema and location supported by the installed IIS version and feature configuration. A default deny can also block local administration. Include the local loopback address when local browser administration must continue, and keep a remote management or console path for recovery.
Handle proxies deliberately
IIS can optionally inspect X-Forwarded-For for restrictions. Enable that behavior only when the reverse proxy or load balancer is trusted and the server can verify the header’s source. If the header is not trustworthy, restrict the proxy’s actual address at the perimeter and configure the application stack to obtain the client address through a trusted, validated mechanism.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Enforce the policy with a host or network firewall
A firewall is the broadest option. It can reject packets before NGINX, Apache, IIS, or another service spends resources processing them. Use it when the policy applies to the whole host, interface, or port, not merely one URL.
Define the perimeter rule
- Identify the public interface and the exact web ports that should be reachable, normally the ports serving HTTP or HTTPS in your deployment.
- Permit required management sources separately from public web traffic.
- Choose whether to reject or silently drop unwanted sources according to your operational and logging requirements.
- Write corresponding IPv6 rules when the host has a public IPv6 listener.
Host tools such as iptables can express source-address and destination-port filters, but syntax, persistence, and the active firewall framework vary by operating system. A rule that is not saved or restored at boot is not a durable policy. Apply the change through the platform’s documented firewall manager, inspect the resulting ruleset, and test from both sides before closing the recovery session.
Understand the trade-offs
| Question | Web-server rules | Firewall rules |
|---|---|---|
| What is protected? | A site, virtual host, location, directory, or proxied service | The host, interface, port, or network boundary |
| When is traffic stopped? | After the web server or stream proxy receives the connection | Before the web service processes the connection |
| Where do you investigate? | Web-server access and error logs | Firewall logs, host telemetry, and upstream device logs |
| How are exceptions expressed? | Directive order or authorization composition | Firewall chain or policy order, depending on the platform |
| What can go wrong? | A wrong client-IP assumption or ordering mistake blocks the wrong users | A broad rule disrupts unrelated services sharing the host or port |
Test, troubleshoot, and recover
An approved user is blocked
- Check whether the user arrived over IPv6 while only an IPv4 range was allowed.
- Compare the address in the server log with the address you intended to permit. A proxy address may be visible instead.
- Review first-match ordering in NGINX, stream rules, IIS entries, or the applicable firewall chain.
- Confirm that the configuration was applied to the active site, virtual host, location, or interface rather than an unused file.
- Use the console or out-of-band path to restore a known-good rule, then retest from the user’s actual network.
A blocked address still reaches the application
- Check every listener and front-end component. The request may be entering through a second proxy, IPv6 listener, or alternate port.
- Verify that the enforcement point sees the client address you are matching.
- Look for an earlier allow rule or a broader exception that matches first.
- Check whether a cached response is being served by an upstream component; confirm with logs at the enforcement point.
Administrators lose access after an allowlist
Restore the approved management range through the console or provider recovery channel. Add the current administrator egress address and the required IPv6 range, validate the configuration, and test from a second management connection before enabling the default deny again. Never rely on one browser session as the only recovery path.
Operational checklist
- Map the request path and identify the trusted client-IP source.
- Decide whether the requirement is a selected-source denylist or a complete allowlist.
- Choose URL/server scope or whole-host/perimeter scope.
- Write IPv4 and IPv6 rules where the service is dual-stack.
- Place narrow exceptions before broad defaults and confirm the platform’s matching semantics.
- Preserve loopback or management access where required.
- Run the platform’s configuration validation before reloading or applying.
- Test from an allowed source, a blocked source, and an IPv6 source when relevant.
- Review web, proxy, and firewall logs to verify the rule—not merely the response seen by a browser.
- Record the change, its owner, the intended scope, and the recovery method.
What IP blocking does not prove
IP filtering is a boundary control, not an identity system. Addresses can be shared, reassigned, translated, or hidden behind proxies, and a determined actor can change sources. The configuration references and security guidance for these products do not provide an authoritative numeric study of attack reduction, added latency, or success rate. Treat blocking as one layer alongside authentication, authorization, patching, rate controls, and monitoring when those controls are required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
