IP allow and deny lists

Every Simple FTP Service has its own firewall: an ALLOW list and a DENY list of IP addresses, edited on the service's Firewall tab in the console.

How the two lists interact

• If the ALLOW list has any entries, only those addresses can connect - everything else is denied, and the DENY list is ignored.
• If the ALLOW list is empty, everyone can connect except addresses on the DENY list.

Entry format

One entry per line. Both lists accept:

• Single addresses - 203.0.113.10
• CIDR ranges - 192.168.1.0/24 to allow or deny a whole network
• Comments - anything after a # on the same line is ignored, so you can label entries: 203.0.113.10 #head office

203.0.113.10   #head office
198.51.100.0/24 #partner network

Invalid addresses or networks are not silently dropped from the display, but they are ignored when connections are checked - double-check your entries after saving.

What this does not cover

These lists control who can connect to your service. If you instead need to know which addresses DocEvent connects to your storage bucket from (for a bucket firewall or ACL), see Backend storage IP addresses. For the addresses your users connect to, see Static IP addresses and ports.