# Restrict backend access to only certain IP

**URL:** <https://forum.mautic.org/t/restrict-backend-access-to-only-certain-ip/29205>\
**Category:** Product Support\
**Tags:** mautic-4\
**Created:** [September 6, 2023, 10:45am UTC](https://forum.mautic.org/t/restrict-backend-access-to-only-certain-ip/29205 "2023-09-06T10:45:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![carlosatfongo](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/carlosatfongo/32/10223_2.png) [@carlosatfongo](https://forum.mautic.org/u/carlosatfongo)\
**Post date:** [September 6, 2023, 10:45am UTC](https://forum.mautic.org/t/restrict-backend-access-to-only-certain-ip/29205/1 "2023-09-06T10:45:22Z")

</div>

**Your software**  
My Mautic version is: 4.4.9  
My PHP versions is: 8.0.30  
My Database type and version is: 10.6.12-MariaDB

**Your problem**  
My problem is: I would like to block the access to the login page and only allow our VPN IP. I tried by adding the following to my nginx configuration but I blocked much more than just the login page.

```auto
location / {
    # try to serve file directly, fallback to app.php
       allow vpnIP;
       allow 127.0.0.1;
       deny all;
    try_files $uri /index.php$is_args$args;
    location ~ \.php$ {
      include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.0-fpm.sock;
    }
}

```

---

<div class="post-metadata">

**Author:** ![carlosatfongo](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/carlosatfongo/32/10223_2.png) [@carlosatfongo](https://forum.mautic.org/u/carlosatfongo)\
**Post date:** [September 11, 2023, 6:07pm UTC](https://forum.mautic.org/t/restrict-backend-access-to-only-certain-ip/29205/3 "2023-09-11T18:07:31Z")

</div>

I guess I solved it like this:

```auto
location ~/s/login {
       allow vpnIP;
       deny all;
    try_files $uri /index.php$is_args$args;
}

```

---

<div class="post-metadata">

**Author:** ![robm](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/robm/32/260_2.png) [@robm](https://forum.mautic.org/u/robm)\
**Post date:** [September 12, 2023, 7:10am UTC](https://forum.mautic.org/t/restrict-backend-access-to-only-certain-ip/29205/4 "2023-09-12T07:10:18Z")

</div>

This is a super useful security hardening step.

ChatGPT tells me the code can be modified to only allow specific IP’s to access the login page

```auto
location ~/s/login {
    allow 127.0.0.1;
    allow 127.0.0.2;
    deny all;
    try_files $uri /index.php$is_args$args;
}

```

Can you foresee any complications? Obv one would have to have a static IP.

---

<div class="post-metadata">

**Author:** ![astrylis](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/astrylis/32/6421_2.png) [@astrylis](https://forum.mautic.org/u/astrylis)\
**Post date:** [September 13, 2023, 7:13am UTC](https://forum.mautic.org/t/restrict-backend-access-to-only-certain-ip/29205/5 "2023-09-13T07:13:04Z")

</div>

There will be no complications, we do this at my company without any problems

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/mautic/original/1X/43c63600fe51440378769136903f1fa2a9a34102.png) [@system](https://forum.mautic.org/u/system)\
**Post date:** [September 14, 2023, 7:14pm UTC](https://forum.mautic.org/t/restrict-backend-access-to-only-certain-ip/29205/6 "2023-09-14T19:14:05Z")

</div>

This topic was automatically closed 36 hours after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![silavapi](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/silavapi/32/7424_2.png) [@silavapi](https://forum.mautic.org/u/silavapi)\
**Post date:** [September 17, 2023, 7:54pm UTC](https://forum.mautic.org/t/restrict-backend-access-to-only-certain-ip/29205/7 "2023-09-17T19:54:20Z")

</div>

Hey folks, it would be great to write this up for the [knowledgebase](https://kb.mautic.org). Anyone fancy taking that on?