IP Lists | SeenSecure Help

✅ Allowlist

The Allowlist contains IP addresses that always have guaranteed access to your site. IPs in this list are evaluated first, before any other firewall rule, and override absolutely everything: Blocklist, Geo Blocking, Rate Limiting, Threat Intelligence, and all other protections.

📋 Key features

Highest priority: Evaluated before any other rule

Overrides everything: Even IPs in the Blocklist pass if they are in the Allowlist

Individual IPs and CIDR: Supports single addresses and full ranges

Ideal for: Offices, corporate VPNs, monitoring services, trusted APIs

✅ Use cases

🏢 Main office IP to avoid blocks from failed login attempts

🌐 Corporate VPN range (198.51.100.0/24) for the whole company

🔗 Trusted external API that needs 24/7 access

📊 Monitoring service (uptime checking) without false positives

📝 Supported format

▪ IP individual:  203.0.113.10
▪ Rango /24:      198.51.100.0/24  (256 IPs)
▪ Rango /16:      192.168.0.0/16   (65,536 IPs)
▪ Rango /8:       10.0.0.0/8      (16M+ IPs)

💡 Recommendation: Always add your current IP to the Allowlist before enabling blocks to avoid accidentally locking yourself out.

🚫 Blocklist

The Blocklist contains IP addresses that are always blocked and cannot access the site under any circumstances, unless they are also in the Allowlist. It is applied immediately after the Allowlist in the firewall protection chain.

📋 Key features

High priority: Applied before Geo Blocking, Rate Limiting, and Threat Intelligence

Can be overridden: Allowlist always takes precedence over Blocklist

Individual IPs and CIDR: Supports single addresses and full ranges

Ideal for: Known attackers, malicious ranges, abusive scraping IPs

🚨 Use cases

🦠 Known attacker identified in previous attacks

🌍 Full range belonging to a botnet (192.0.2.0/24)

🤖 Scraping bot that downloads content massively

🔨 IPs with repeated brute-force login attempts

⚠️ Precautions

🔴 Only use large CIDR ranges if you are sure the entire range is malicious

📈 Too many IPs can impact performance (especially /16 or /8 ranges)

✅ Verify in the Traffic Log before blocking an entire range

🔗 Relation to IP Management

This tab (Firewall → IP Lists) and the separate IP Management page (menu: Firewall → IP Management) are connected but serve different purposes:

🧾 IP Lists (this tab)

Manual Allowlist and Blocklist that you edit here. They have the highest priority in the firewall chain. They are permanent configuration that only changes when you edit them.

📋 IP Management → Blacklist / Whitelist

The same IPs you add here also appear in the Blacklist and Whitelist tabs of IP Management, marked in the "Source" column with the 🔒 icon and the label "IP Lists". There they show up as permanent (no expiry date) and locked for editing — you can only change them from this tab, not from IP Management.

💡 Don't confuse it with "Blocked IPs": IP Management also has a separate tab called "Blocked IPs", which is a different, dynamic list: it shows the IPs the WAF itself blocks automatically (for example, after crossing a Rate Limiting threshold), almost always with a temporary expiry unless you mark them permanent. That list has no direct relation to the Allowlist/Blocklist on this tab.

⚙️ Performance and scalability

Each IP or CIDR range in the lists is evaluated on every HTTP request. With a few entries (tens or hundreds) the impact is minimal. However, very large ranges or lists with thousands of entries can slow down the site:

✅ Good performance

Individual IPs: negligible impact
/24 ranges: minimal impact
Up to ~500 total entries: normal performance

⚠️ Possible impact

/16 ranges or larger: noticeable impact
1,000+ entries: incremental latency
10,000+ entries: significant slowdown

📌 Performance tip: To block entire countries or very large ranges, use Geo Blocking instead of the Blocklist. Geo Blocking is optimized for geographic ranges and performs better with large lists.