What's the difference between allow mode and deny mode?

Allow mode treats your CIDR list as the only ranges permitted, and appends a catch-all deny for everything else (deny all in Nginx, a negated ACL match in HAProxy, DROP as the implicit default in iptables). Deny mode does the opposite: your list is blocked, and a catch-all allow covers everyone else.

Why does the Nginx output end with `deny all;` or `allow all;`?

Nginx's allow/deny directives are evaluated top to bottom, and without a final catch-all rule, requests that don't match any listed CIDR would fall through with no explicit decision. Adding the appropriate catch-all at the end makes the intended behavior explicit rather than relying on Nginx's default.

Does the HAProxy output block or just log matching requests?

It generates an `http-request deny` action, which returns a 403 response and stops processing that request. Swap `deny` for `tarpit` or a custom action in your own HAProxy config if you want different handling.

Does the iptables output persist across reboots?

No. These are raw `iptables` commands; save them with your distribution's persistence tool (iptables-persistent, netfilter-persistent, or an equivalent) so they survive a reboot.

IP Allow List Generator - Nginx, HAProxy & iptables

Overview

Introduction

Restricting access to a set of known IP ranges is one of the most common perimeter controls, but the syntax for expressing it differs completely across Nginx, HAProxy, and iptables.

This tool takes one list of CIDR ranges and an allow-or-deny mode, and produces correct syntax for all three, entirely in your browser.

What Is IP Allow List Generator?

A CIDR-based allow/deny list generator targeting three common enforcement points: Nginx's allow/deny directives, an HAProxy ACL plus http-request deny rule, and raw iptables commands.

It's part of this site's Network Tools collection and validates every CIDR range before generating output.

How IP Allow List Generator Works

Every entered value is checked against strict IPv4 CIDR syntax (four dotted octets 0-255 followed by /0-32) before anything is generated.

In allow mode, each CIDR becomes an explicit permit rule with a trailing catch-all deny; in deny mode, each CIDR becomes an explicit block rule with a trailing catch-all allow, matching how each target technology evaluates its rules in order.

When To Use IP Allow List Generator

Use it when restricting an admin panel, internal API, or staging environment to a known set of office or VPN IP ranges.

It's also useful when blocking a small number of known-bad ranges at the edge, without writing the target syntax from memory.

Often used alongside CIDR Subnet Calculator, Firewall Rules Generator and Nginx Rewrite Generator.

Features

Advantages

Produces three different targets' syntax from one shared input, so you don't need to re-derive the logic per platform.
Strict CIDR validation catches a malformed range before it reaches a production config.
Always includes the necessary catch-all rule, avoiding a common Nginx allow/deny mistake where the list falls through with no default.

Limitations

IPv4 CIDR ranges only; IPv6 ranges aren't validated or generated.
The iptables output targets the INPUT chain only; adapt the chain name if you're filtering a different chain or using a custom table.

Examples

Allowing two office ranges in Nginx

Input

cidrs: [203.0.113.0/24, 198.51.100.0/24], mode: allow, format: nginx

Output

allow 203.0.113.0/24;
allow 198.51.100.0/24;
deny all;

Both ranges are explicitly permitted, and the trailing deny all; blocks everything not on the list.

Blocking a single range in iptables

Input

cidrs: [192.0.2.0/24], mode: deny, format: iptables

Output

iptables -A INPUT -s 192.0.2.0/24 -j DROP

A single DROP rule targeting the INPUT chain for traffic sourced from that CIDR.

Best Practices & Notes

Best Practices

Double-check your own current IP is included in an allow list before applying it to something you access remotely, to avoid locking yourself out.
Keep the CIDR list as tight as reasonably possible; a /24 admits 256 addresses, so prefer the smallest range that still covers your legitimate sources.
For iptables, remember rule order matters if you're combining this output with other existing rules; place these near the top of the relevant chain.

Developer Notes

CIDR validation checks each of the four octets is within 0-255 and the prefix length is within 0-32 using a plain regex plus range check, deliberately not attempting to normalize non-canonical CIDR forms (like 10.0.0.5/24) since the generated rules apply prefix-based matching regardless of whether the host bits are zeroed.

IP Allow List Generator Use Cases

Restricting access to an internal admin panel or dashboard to office and VPN IP ranges
Blocking a handful of known-abusive IP ranges at the web server or load balancer
Producing consistent allow/deny config across a mixed Nginx/HAProxy/iptables environment from one source list

Common Mistakes

Forgetting the catch-all rule when hand-writing Nginx allow/deny blocks, leaving unmatched requests in an undefined state.
Using an overly broad CIDR (like a /8) when a much smaller range would cover the actual legitimate sources.

Tips

Use the CIDR Subnet Calculator first if you're unsure exactly which prefix length covers a given IP range.

IP Allow List Generator