Access Control Rules

Access rules determine whether a license check is allowed or denied based on the client's network identity. Rules can be applied at three scopes.

Rule Scopes

Rule Types

• IP Address — a single IPv4 or IPv6 address (e.g., 192.168.1.100).
• CIDR Block — a subnet range (e.g., 10.0.0.0/8).
• FQDN — a fully qualified domain name (e.g., app.example.com).

Each rule can be set to either allow (whitelist) or block (blacklist).

Precedence Order

Rules are resolved in strict precedence order. The first matching rule wins:

1. License-level rules (highest priority)
2. Product-level rules
3. Global rules (lowest priority)

Within each scope, block rules take precedence over allow rules. This means a license-level block will override a product-level allow.

Default Behavior

If no rules match, the system applies the default policy. The default depends on the block_all_until_whitelisted flag, which can be set at the product or license level (and inherited from the product default):

• When block_all_until_whitelisted is true, access is denied unless an allow rule explicitly permits it.
• When block_all_until_whitelisted is false, access is allowed unless a block rule explicitly denies it.

Examples

Scenario: You want to allow access only from your corporate VPN subnet and block a specific IP.

• Global rule: Block 203.0.113.50
• Global rule: Allow 10.99.0.0/16

All license checks from within the VPN subnet will pass. The blocked IP will be denied even if it falls within the allowed subnet (block wins at same scope).

Scenario: Block a license from resolving on a specific subdomain.

• License-level rule: Block FQDN leaked.example.com

This overrides any product-level allow and denies checks that include that FQDN.