How do I make the admin panel accessible only from specific IPs?

Short answer

Two conditions are created that define the management path (e.g. Path, Regex ^/+admin(/.*)?$, Case Insensitive) and the allowed addresses (Source IP → Manual); in the Block action, the path condition and the negated form of the allowed address condition (!ofis) are combined with and, and the action is added to the Actions field of the vService. In this way, requests to the management path that do not come from the allowed addresses are blocked with 403. Dynamic List can be used for long address lists, and Show Content for a branded block page; if TR7 is behind a CDN or proxy, Trusted Proxy is defined first.

Problem: The Admin Panel Is Open to Everyone

When the admin panel is open to the internet, it becomes the target of password guessing and scanning requests. It is desired that the panel is accessed only from office or VPN addresses, and that other requests are blocked before they reach the Backend Service.

Solution: Six Methods

All the methods rely on two conditions: a condition that recognizes the management path (or the domain name) and a condition that recognizes the allowed addresses. The difference is in the response given to the unauthorized request. The Source IP condition must see the real address of the client; if there is a CDN or a reverse proxy in front of TR7, There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)? is applied first.

Your situation	Suitable method
Path-based (or domain-name-based) restriction, 403 for the unauthorized	Method 1: Block + Path + negative Source IP
A long or frequently changing address list	Method 2: Dynamic list
Showing a branded page to the blocked user	Method 3: Show content
Sending the blocked user to an information page	Method 4: Location redirection
A management service published with L7 TCP (RDP, SSH)	Method 5: TCP Connection Management
From the command line	Method 6: WEB-CLI

Method 1: Block + Path + Negative Source IP Recommended

• How it works If the path condition is met and the request does not come from the allowed addresses, the request is blocked with 403 without going to the Backend Service.
• Where it is openedLoad Balancer → Conditions · Load Balancer → Actions → Block
• Requirement Source IP sees the real client address (Trusted proxy when behind a proxy)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the path condition form

Load Balancer → Conditions → Add is clicked (how to add).

2

Adım 2 Define the management path

Criteria = Path, matching Regex, value ^/+admin(/.*)?$, Case Insensitive checked (admin panel scenario). The result of the pattern:

Path	Does it match?
/admin, /admin/, /admin/login, /ADMIN/login, //admin/	Yes
/administrator, /adminx/, /static/admin/x	No

If the panel is on a separate domain name (e.g. admin.example.com), the HTTP Header condition is used instead of the path: Header name = Request Host, Exact match, Case insensitive, value admin.example.com. If the panel is on its own vService, the path condition is not needed.

3

Adım 3 Save the path condition

Add is clicked.

4

Adım 4 Open the allowed address condition form

Load Balancer → Conditions → Add is clicked.

5

Adım 5 Write the allowed addresses

Criteria = Source IP, Source IP Type = Manual. Addresses and CIDR blocks are written separated by a space or a line break; a comment is written only at the beginning of the line with #:

# Office
198.51.100.0/24
# VPN exit
198.51.100.77

6

Adım 6 Save the allowed address condition

Add is clicked.

7

Adım 7 Open the Block action form

Load Balancer → Actions → Add is clicked (how to add).

8

Adım 8 Define the block

Action Name is entered, and Action Type = Block is selected.

• Execution Level = On request (default).
• Deny Type = Standard (default); the other options are Tarpit and Silent drop.
• Status Code = 403 (default); 404 to hide the existence of the path.
• Conditions: the path condition (admin-yolu) and the !-prefixed negated form of the allowed address condition (!ofis) are added to the same group, and the operator between them is left as and (Can I use a condition in negated form ("if not")?).
• If Hit Counter is turned on, the blocked requests are counted.

9

Adım 9 Save the action

Add is clicked.

10

Adım 10 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

11

Adım 11 Add the action to the Actions field

The action is selected in the Details → Actions field.

12

Adım 12 Save

Save is clicked. The change is applied without dropping open connections; in a cluster, it is also sent to the peer device with the default auto-sync (if Manual Sync Mode is on, with Synchronize).

Verification

1Unauthorized addressClient side

From outside the office network, curl -sI https://www.example.com/admin/ and curl -sI --path-as-is https://www.example.com//ADMIN/

Expected403 Forbidden

2Allowed addressClient side

The same request is sent from the office network; the status codes of the two requests are compared on the HTTP Logs screen.

Expected200 from the office · 403 from outside

Method 2: Dynamic List (IP/cidr match)

• How it works The allowed addresses are kept in a long list; the negated form of the list is combined with the path condition.
• Where it is openedLoad Balancer → Conditions → Dynamic List
• Requirement The path condition in Method 1
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the list condition form

Load Balancer → Conditions → Add is clicked.

2

Adım 2 Define the list

Criteria = Dynamic List; Key to Search is left at the default client IP variable; Search Method = IP/cidr match; the allowed addresses and blocks are written in the List field.

3

Adım 3 Save the condition

Add is clicked.

4

Adım 4 Open the Block action form

Load Balancer → Actions → Add is clicked.

5

Adım 5 Define the block

Action Name is entered, and Action Type = Block is selected; it is filled in as in step 8 of Method 1, and instead of the allowed address condition, the !-prefixed negated form of this list is selected.

6

Adım 6 Save the action

Add is clicked.

7

Adım 7 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

8

Adım 8 Add the action to the Actions field

The action is selected in the Details → Actions field.

9

Adım 9 Save

Save is clicked.

Verification

1ResponseClient side

From an address that is not in the list and from one that is in the list, curl -sI https://www.example.com/admin/

ExpectedNot in the list 403 · in the list 200

Method 3: Block Page with Show Content

• How it works A branded access block page is shown to the blocked requests with the 403 code.
• Where it is openedLoad Balancer → Actions → Show Content
• Requirement The two conditions in Method 1; the block page in Content Pages or the built-in Access Denied Page
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Show content form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Select the page and the code

Action Name is entered, and Action Type = Show content is selected. Execution Level = On request; Content Page = Access Denied Page (Turkish) or a custom page (What is the Content Pages profile; how do I prepare my own HTML page?); Status Code = 403 (default 200); Conditions are set up as in Method 1.

3

Adım 3 Save the action

Add is clicked.

4

Adım 4 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

5

Adım 5 Add the action to the Actions field

The action is selected in the Details → Actions field.

6

Adım 6 Save

Save is clicked.

Verification

1ResponseClient side

From outside the office network, curl -i https://www.example.com/admin/

ExpectedHTTP/1.1 403 + block page

Method 4: Location Redirection

• How it works The blocked requests are redirected to an information page with 302.
• Where it is openedLoad Balancer → Actions → Location Redirection
• Requirement The two conditions in Method 1; the target address outside the management path
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Location redirection form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Enter the target and the conditions

Action Name is entered, and Action Type = Location Redirection is selected. Redirect Code = 302: Found (Moved Temporarily); Redirect Location = /erisim-bilgisi; Conditions are set up as in Method 1.

3

Adım 3 Save the action

Add is clicked.

4

Adım 4 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

5

Adım 5 Add the action to the Actions field

The action is selected in the Details → Actions field.

6

Adım 6 Save

Save is clicked.

Verification

1ResponseClient side

From outside the office network, curl -sI https://www.example.com/admin/

Expected302 + Location: /erisim-bilgisi

Method 5: L7 TCP Services: TCP Connection Management

• How it works On management services published with an L7 TCP vService, such as RDP or SSH, the connections that do not come from the allowed addresses are closed.
• Where it is openedLoad Balancer → Actions → TCP Connection Management
• Requirement The allowed address condition in Method 1
• vService type L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Define the rejection

Action Name is entered, and Action Type = TCP Connection Management is selected. Execution level = On request (default); Action = Reject (default); in the Conditions field, the negated form of the allowed address condition (!ofis) is selected (Is it possible to reject or silently drop a connection at the TCP level (TCP Connection Management)?).

3

Adım 3 Save the action

Add is clicked.

4

Adım 4 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the L7 TCP vService is selected and Edit is clicked.

5

Adım 5 Add the action to the Actions field

The action is selected in the Details → Actions field.

6

Adım 6 Save

Save is clicked.

Verification

1ConnectionClient side

A connection to the service is made from outside the office network (e.g. an RDP client).

ExpectedThe connection is closed by TR7

Method 6: WEB-CLI

• How it works The two conditions in Method 1, the Block action and the vService binding are created with WEB-CLI commands.
• Where it is opened TR7 WEB-CLI → lb condition · lb action · lb service
• Requirement WEB-CLI access; the identifiers (IDs) of the two conditions
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Add the path condition

Since the pattern does not contain |, it can be written on the command line:

lb condition add criteria path query "^/+admin(/.*)?$" --content_placement regex --caseInsensitive true --name admin-yolu

2

Adım 2 Add the allowed address condition

The addresses are separated by spaces:

lb condition add criteria src_ip srcIpType manual src "198.51.100.0/24 198.51.100.77" --name ofis

3

Adım 3 Get the IDs of the conditions

The action binds the conditions by their IDs, not by their names; lb condition add produces no output when it succeeds; the IDs are seen in the id column of the lb condition list output.

4

Adım 4 Add the Block action

In the condition expression, ! indicates the negated form and and indicates combination; the expression is written in double quotes. If Deny type and Status code are not written, Standard and 403 are used:

lb action add type deny name admin-kilidi --cond "<path-id> and !<office-id>"

5

Adım 5 Check the existing actions on the vService

lb service show <vService>

--rules.N replaces the action at that position; the new action is written to the first empty position.

6

Adım 6 Add the action to the vService

If the vService has two actions (0 and 1), the new action is written to position 2; if it has no actions, --rules.0 is used:

lb service update id <vService> --rules.2 admin-kilidi

Verification

1ResponseClient side

From outside the office network, curl -sI https://www.example.com/admin/

Expected403 Forbidden

Common Mistakes

While the allowed address list is empty, its negated form blocks everyone

If the Source IP → Manual list is left empty or consists only of comment lines starting with #, the condition does not match any client; in this case, its negated form (!ofis) is met for everyone, and the management path is closed from the office as well.

• Not defining Trusted proxy while TR7 is behind a CDN or proxy. The Source IP condition sees the address of the proxy; either everyone is allowed or everyone is blocked. First, the real client IP is resolved (There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?).
• Using Exact match. /admin/ with Exact match misses the /admin/login request; Regex or Start is used.
• Not taking the different spellings of the path into account. The Path condition evaluates the path as it was sent in the request; Case insensitive is needed for /ADMIN/, and ^/+ in the pattern for //admin/. A Start /admin/ condition does not catch these two spellings.
• Writing the comment next to the address. A comment is written only at the beginning of the line with #; an inline comment such as 198.51.100.0/24 # ofis causes the subsequent addresses in the list not to be taken into account.
• Testing the rule from one direction only. Tests are made from both an allowed and an unauthorized address; the internet egress address (NAT) of the office must be in the list.

How it is done in the documentation

• Block · Scenario 3: General Admin Path Protection
• Source IP · Scenario 2: Admin Panel IP Whitelist Protection
• Path · Scenario 2: Admin Panel Access Control
• Conditions · Automatic NOT (Negation) Condition Creation

Related questions

• Can I use a condition in negated form ("if not")?
• There is a CDN such as Cloudflare / Akamai in front of TR7; how do I get the Real client IP (trusted proxy)?
• Can I return content directly for certain requests without going to the backend (Show Content)?
• Is it possible to reject or silently drop a connection at the TCP level (TCP Connection Management)?