Allow list, safe list and bans: the three IP lists

Syncplify Server! keeps three lists of IP addresses and networks per virtual site, and their names are easy to confuse. Here is what each of them does.

Bans (the block list, formerly known as blacklist) is where the "bad guys" end up: any address or network that the Shield caught attacking the server, or that an administrator banned by hand. A banned address is refused the moment it connects. Bans live on the Shield page of the Admin UI, Bans tab, where you can add, lift and make them permanent.

Allow list (formerly known as whitelist) is the restrictive one. If the list is empty, clients can connect from anywhere, and most administrators run their server that way. If it contains even a single address or network, it becomes active: the server accepts connections only from what the list contains and refuses every other source at accept, before any handshake. A refused source is not struck and is not banned; it is simply not admitted. Enabling the allow list, in practice, means permanently excluding everyone who is not on it. It lives on the Access enforcement page of the Admin UI.

WARNING

Allow listing an address does not prevent that address from being banned. An address on the allow list that fails five sign ins is banned like any other. If an address must never be banned, put it on the safe list.

Safe list names the addresses and networks the Shield never bans, whatever they do: your own offices, your monitoring systems, your integration partners, and above all your load balancers and health checkers, which open connections and close them without signing in and look like scanners to any rule. A safe listed address is still authenticated normally (a wrong password is still a wrong password), and it is still subject to the allow list. It lives on the Shield page, Safe list tab.

Used together, the three lists cover a wide variety of situations: a server open to the world with the Shield watching it, a server that only the partner's network may reach, a cluster behind a load balancer that must never be banned, and every combination in between.

Address formats

Every list accepts single IPv4 or IPv6 addresses, such as 192.168.172.23, and networks in CIDR notation, such as 192.168.172.0/24 or 2001:db8::/32. The dotted netmask form of older versions (10.23.5.0/255.255.255.0) is not accepted in v8: write 10.23.5.0/24.

The other places an address can be restricted

• Each user has an allow list of their own, on the Network access tab of the user editor: when it is not empty, that account can sign in only from those addresses.
• The management console (the SuperAdmin and Admin web interfaces) has its own Shield and its own safe list, in the Global Configuration of the SuperAdmin UI. The nodes of a cluster are exempt from the console's Shield automatically.
• The R2FS! page of the Admin UI has an allow list for the storage nodes that may connect.

Before version 8.3.0

Versions before 8.3.0 have the same three lists, block list, allow list and safe list, with Protector! as the engine behind the block list. The manual page Shield, safe list, allow list describes the current behavior in full.