How to restrict FusionAuth admin panel access to specific IP addresses?

[FASupportBot]

We want to restrict access to the FusionAuth admin panel so that only our internal network can reach it, while keeping the rest of the service (user login, APIs, etc.) accessible to all users from anywhere.

Specifically:

• Admin panel should only be accessible from our corporate network IP addresses (e.g., VPN and secure access gateway IPs)
• All other FusionAuth functionality (OAuth flows, user authentication, APIs) should remain publicly accessible
• We're using FusionAuth Cloud

Is there a way to implement IP-based access control for just the admin interface? Also, what's the recommended fallback approach if we accidentally lock ourselves out?

[FASupportBot]

Recommended Approaches for FusionAuth Cloud

Since you're using FusionAuth Cloud, here are your options for restricting admin panel access:

Use IP ACLs

You can use the IP ACLs and assign them to the FusionAuth application, which represents the FusionAuth admin UI.

These are an enterprise only feature, so if you are not on that plan, you can't use IP ACLs.

Additional Security Layers

While these don't replace IP restrictions, they add defense in depth:

• Tenant Separation: Move all non-admin users to a separate tenant, keeping the default tenant for administrators only
• Strong MFA: Require multi-factor authentication for all admin users
• API Key Security: If you use IP ACLs with API keys (see below), you can restrict which IPs can use specific API keys

What IP ACLs ARE Good For

While IP ACLs don't protect the admin UI directly, they're still valuable for:

1. Restricting application access - Apply an IP ACL to specific applications to limit which IPs can authenticate to those apps
2. Restricting tenant access - Apply an IP ACL to a tenant to limit logins across all applications in that tenant
3. Restricting API key usage - Apply an IP ACL to API keys to limit which IPs can use them

To configure an IP ACL:

1. Navigate to Settings > IP Access Control
2. Click the + icon to create a new ACL
3. Add IP ranges and specify whether to allow or block them
4. Set a default action (allow or block) for IPs that don't match any defined range
5. Assign the ACL to an Application, Tenant, or API Key

Emergency Access / Lockout Prevention

Before implementing any IP restrictions (whether via proxy or IP ACLs):

1. Create a backup API key with full admin privileges that you store securely
2. Test your configuration from an allowed IP address first
3. Document your IP ranges and keep them updated
4. Have a rollback plan - If using a proxy, ensure you can quickly remove or modify the IP restrictions

If you do get locked out:

• With IP ACLs on API keys/tenants: Use an unrestricted API key to call the FusionAuth API to modify or remove the ACL
• Last resort: Contact support (Cloud)

Related Documentation

• Advanced Threat Detection - IP Access Control Lists
• IP Access Control List API
• Networking Configuration (Trusted Proxies)
• FusionAuth Cloud Deployment
• Community Forum: Restricting Admin Panel Access