Skip to content

L4 ACL Rules

L4 ACLs allow source networks before deeper application checks. Use them for administrative traffic, trusted internal networks, load balancers, and approved upstream integrations.

Syntax

allow4=<IPv4 CIDR>
allow6=<IPv6 CIDR>
deny4=<IPv4 CIDR>
deny6=<IPv6 CIDR>

Example

allow4=203.0.113.10/32
allow4=10.0.0.0/8
allow6=2001:db8::/32
allow4=127.0.0.1/32
allow6=::1/128

Best practices

  • Use CIDR notation even for single IPs.
  • Keep admin allowlists separate and documented.
  • Avoid 0.0.0.0/0 in restrictive production deployments unless global access is intentional.
  • Include load balancer and container network ranges when Core sees traffic from those networks.