![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
/
- Overview
- Get started
- Concepts
- Traffic detections
- Overview
- Attack score
- Malicious uploads
- Bot score
- Threat intelligence
- Custom rules
- Overview
- Create in the dashboard
- Create via API
- Create using Terraform
- Configure a rule with the Skip action
- Common use cases
- Allow traffic from IP addresses in allowlist only
- Allow traffic from search engine bots
- Allow traffic from specific countries only
- Block Microsoft Exchange Autodiscover requests
- Block requests by attack score
- Block traffic by geographical location
- Block traffic from specific countries
- Build a sequence rule within custom rules
- Challenge bad bots
- Configure token authentication
- Exempt partners from Hotlink Protection
- Issue challenge for admin user in JWT claim based on attack score
- Require a specific cookie
- Require known IP addresses in site admin area
- Require specific HTTP headers
- Require specific HTTP ports
- Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
- Update custom rules for customers or partners
- Custom rulesets
- Managed rules
- Overview
- Deploy in the dashboard
- Deploy via API
- Deploy using Terraform
- Troubleshooting
- Create exceptions
- Log the payload of matched rules
- Additional tools
- Account-level configuration
- Overview
- Custom rulesets
- Rate limiting rulesets
- Analytics
- Security features interoperability
- Reference
- Alerts
- Phases
- Legacy features
- WAF managed rules (previous version)
- Rate Limiting (previous version)
- Firewall rules
- Firewall rules upgrade
- Glossary
- Home
- /WAF
- /…Additional tools
- /IP Access rules
- /Parameters
IP Access rules parameters
OverviewIP addressIP rangeAutonomous System Number (ASN)Country
An IP Access rule will apply a certain action to incoming traffic based on the visitor's IP address, IP range, Autonomous System Number (ASN), or country.
| Type | Example value |
|---|---|
| IPv4 address | 192.0.2.3 |
| IPv6 address | 2001:db8:: |
| Type | Example value | Start of range | End of range | Number of addresses |
|---|---|---|---|---|
IPv4 /24 range |
192.0.2.0/24 |
192.0.2.0 |
192.0.2.255 |
256 |
IPv4 /16 range |
192.168.0.0/16 |
192.168.0.0 |
192.168.255.255 |
65,536 |
IPv6 /128 range |
2001:db8::/128 |
2001:db8:: |
2001:db8:: |
1 |
IPv6 /64 range |
2001:db8::/64 |
2001:db8:: |
2001:db8:0000:0000:ffff:ffff:ffff:ffff |
18,446,744,073,709,551,616 |
IPv6 /48 range |
2001:db8::/48 |
2001:db8:: |
2001:db8:0000:ffff:ffff:ffff:ffff:ffff |
1,208,925,819,614,629,174,706,176 |
IPv6 /32 range |
2001:db8::/32 |
2001:db8:: |
2001:db8:ffff:ffff:ffff:ffff:ffff:ffff |
79,228,162,514,264,337,593,543,950,336 |
| Type | Example value |
|---|---|
| ASN | AS13335 |
Specify a country using two-letter ISO-3166-1 alpha-2 codes . Additionally, the Cloudflare dashboard accepts country names. For example:
USCNgermany(dashboard only)
Cloudflare uses the following special country alpha-2 codes that are not part of the ISO:
T1: Tor exit nodes (country name:Tor)XX: Unknown/reserved
Notes
Country block is only available on Enterprise plans.
IP addresses globally allowed by Cloudflare will override a country block via IP Access rules, but they will not override a country block via custom rules.
2026 Cloudflare, Inc.
[privacy options]Your privacy choices
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}