[id='endpoint-ip-address-filters_{context}']
= Endpoint IP address filtering rules

{brandname} Server endpoints can use filtering rules that control whether clients can connect based on their IP addresses.
{brandname} Server applies filtering rules in order until it finds a match for the client IP address.

A CIDR block is a compact representation of an IP address and its associated network mask.
CIDR notation specifies an IP address, a slash ('/') character, and a decimal number.
The decimal number is the count of leading 1 bits in the network mask.
The number can also be thought of as the width, in bits, of the network prefix.
The IP address in CIDR notation is always represented according to the standards for IPv4 or IPv6.

The address can denote a specific interface address, including a host identifier, such as `10.0.0.1/8`, or it can be the beginning address of an entire network interface range using a host identifier of 0, as in `10.0.0.0/8` or `10/8`.

For example:

* `192.168.100.14/24` represents the IPv4 address `192.168.100.14` and its associated network prefix `192.168.100.0`,
or equivalently, its subnet mask `255.255.255.0`, which has 24 leading 1-bits.
* the IPv4 block `192.168.100.0/22` represents the 1024 IPv4 addresses from `192.168.100.0` to `192.168.103.255`.
* the IPv6 block `2001:db8::/48` represents the block of IPv6 addresses from `2001:db8:0:0:0:0:0:0` to
`2001:db8:0:ffff:ffff:ffff:ffff:ffff`.
* `::1/128` represents the IPv6 loopback address. Its prefix length is 128 which is the number of bits in the address.

[discrete]
== IP address filter configuration

In the following configuration, {brandname} Server accepts connections only from addresses in the `192.168.0.0/16` and `10.0.0.0/8` CIDR blocks.
{brandname} Server rejects all other connections.

.XML
[source,xml,options="nowrap",subs=attributes+,role="primary"]
----
include::xml/server_ipfilter.xml[]
----

.JSON
[source,json,options="nowrap",subs=attributes+,role="secondary"]
----
include::json/server_ipfilter.json[]
----

.YAML
[source,yaml,options="nowrap",subs=attributes+,role="secondary"]
----
include::yaml/server_ipfilter.yaml[]
----
