IP Access Manager

The IP Access Manager limits where people can log in to NolaPro from. When IP filtering is on, a login is only accepted from the IP addresses (or address ranges) you list, either for everyone or for individual users. It is a simple way to keep a self-hosted install reachable only from the office, a VPN, or a few known remote locations.

Requirements

The IP Access Control feature must be enabled, and the page is a Company Supervisor page unless it is granted to a user under Advanced User Rights (Tools, IP Access Manager). Plan the address list before turning filtering on (see the warning below).

Turning on IP filtering

Where: Tools -> System -> IP Access Manager

1) IP Login Filtering Status is Off by default, which means no address checks are made at login. Select on and the address boxes appear below, with a reminder that ranges can be written like 192.168.1.0/24 and that logging in from the server itself is always allowed.

2) Under Filtering Options for All Users, in All Users Can Access The System From These IP Addresses, enter the addresses every user may log in from, separated by commas. A range can be written in CIDR form, for example 192.168.1.0/24 for a whole office subnet.

3) Under Per-User Filtering Options there is one Allowed IP Addresses box for every active user account (name and username are shown; inactive and cancelled users are not listed). Addresses entered for a user are allowed for that user in addition to the all-users list, which lets you give a remote worker their home or VPN address without opening it to everyone.

4) Click Save at the bottom of the page. The filter status and every address box are saved together and the page reloads with the saved values; the rules apply to the next login attempt. The per-user addresses are only stored while the status is on; addresses typed while saving with Off are discarded.

Notes

• Warning: enter at least one address you can actually reach the server from before you save with filtering on. Otherwise you can only log in from the server itself (its IPv4 loopback address 127.0.0.1), which is always allowed.
• A user with no address of their own and no all-users addresses cannot log in while filtering is on.
• Entering the range 0.0.0.0/0 allows every address, which is the same as turning filtering off for that list.
• Spaces around the commas are ignored.
• The check happens at login only (including Employee Time Clock kiosk logins); a user who is already logged in is not disconnected when you change the lists.