I have created a web app and deployed flask app in it. Also, i have created IP access restriction rule to enable access only to my local machine to access the web app url but still i am not able to access the URL though i have added rule with my local machine IP address. Do we need to use any specific IP details ? Please guide me on this. Thanks in advance!!! Note: I have restricted all access by selecting "Deny" option in unmatched rule settings.

Hi Vijayakumar, You need to use your public IP address in the Allow rule instead of your local machine's private IP. You can find your public IP address by browsing to one of the public sites that show your address such as whatismyip.com, ip.me, and many others. Please click Accept Answer and upvote if the above was useful. Thanks. -TP

IP access restriction rule not working in Azure web app.

Accepted answer

TP 100.1K Reputation points

2023-10-19T04:21:43.67+00:00

Hi Vijayakumar,

You need to use your public IP address in the Allow rule instead of your local machine's private IP. You can find your public IP address by browsing to one of the public sites that show your address such as whatismyip.com, ip.me, and many others.

Please click Accept Answer and upvote if the above was useful.

Thanks.

-TP
Please sign in to rate this answer.
Vijayakumar Elumalai 105 Reputation points

2023-10-19T04:41:52.11+00:00

Thanks for the input. What about the CIDR number of public ip address ? like it's 24 or 32 ? How to find it ?

TP 100.1K Reputation points

2023-10-19T04:47:15.47+00:00

You can just enter your public IP address in the box and it will add /32 on the end of it for you. Or, if you want, you can take your public IP address and append /32 on the end and enter that in the box.

Vijayakumar Elumalai 105 Reputation points

2023-10-19T04:50:50.1133333+00:00

Still it's not allowing to access the URL. Used /32 notation.

TP 100.1K Reputation points

2023-10-19T05:05:04.4933333+00:00

Did you click Save button after you created the rule?

Below is sample screenshot of how your rules should look. For the sample, I browsed to api.ipify.org and and it returned 208.24.36.51 for public IP, so that is what I used for the "Allow my IP" Allow rule. After adding the rule I clicked Save button to apply the changes.

VenkateshDodda-MSFT 22,401 Reputation points Microsoft Employee

2023-10-19T05:11:55.28+00:00

Elumalai, Vijayakumar Thanks for reaching out to Microsoft Q&A, I understand that you want to find the CIDR of your public IP and this can be done by using 3rd party public sites like whois.

In the screenshot that you shared, I can see that your public IP address is 192.168.1.4 then your CIDR might be 192.168.0.0/16 as shown below.

Vijayakumar Elumalai 105 Reputation points

2023-10-19T05:50:52.8233333+00:00

So which public ID should i have to use ? because get IP address using whatismyip.com & ip.me these 2 sites are not working. IP address is 136.226.252.255 so i found the relevant CIDR using whois and that is below screenshot. Tried with both options like

136.226.255.255/16 & 136.226.0.0/16 & both are not working.

NetRange: 136.226.0.0 - 136.226.255.255 CIDR: 136.226.0.0/16

But, when using api.ipify.org this for IP address it is working. Is it correct way ? can we use this site to get IP address and restrict access ? Will this IP addresses change ?

TP 100.1K Reputation points

2023-10-19T06:09:03.6466667+00:00

.255 is for broadcast so that isn't correct. That address belongs to zscaler, are you using their service? Whether or not your public IP address will remain the same depends on your IP configuration and Internet Service Provider.

For example, some people are connecting from their office PC, and their office has a static public IP address that is used for outgoing connections. In this example adding a rule works well because the public IP is always the same.

On the other hand, if you are connecting from your laptop and you do a lot of traveling, connecting from different hotels/airports/etc., then you will constantly need to update the rules. If using some sort of VPN, SDWAN, vWAN, etc., this affects things too.

Another example, people connect from home and their public IP address remains the same for perhaps weeks/months, then changes to a new address without notice. When these changes occur the rules would need to be updated.

As to whether or not api.ipify.org will always work for you going forward, again that depends on your specific local network configuration, physical location, and of course the service. whatismyip has worked for me most of the time when in USA, however, occasionally it doesn't so I try a different site.

Please click Accept Answer to close up this thread.

Thank you.

TP 100.1K Reputation points

2023-10-20T05:45:54.36+00:00

@Anonymous Any update?

Vijayakumar Elumalai 105 Reputation points

2023-10-20T05:48:43.9+00:00

Using api.ipify.org this and get IP to grant permission is the right approach for security right ?

TP 100.1K Reputation points

2023-10-20T05:52:32.32+00:00

@Elumalai, Vijayakumar Yes, that is correct, if your goal is to only allow connections to your web app from your public IP.

Please remember to click Accept Answer to close up this thread.

Thank you.

Vijayakumar Elumalai 105 Reputation points

2023-10-20T10:15:12.7866667+00:00

Final ask - Is there a way to block using private IP instead of public IP ? Like local machine IP ?

Vijayakumar Elumalai 105 Reputation points

2023-10-25T04:55:31.65+00:00

@TP api.ipify.org this IP address is keeps on changing. Any solution for this ?

TP 100.1K Reputation points

2023-10-25T14:35:34.4833333+00:00

@Elumalai, Vijayakumar Please see below:

Final ask - Is there a way to block using private IP instead of public IP ? Like local machine IP ?

A: When you connect to a public web site, regardless of if it's on Azure or other provider, the site has no idea what your private IP is, so it has no ability to block based on that. What you could potentially do is connect to your Virtual Network via Point-to-Site connection to VPN Gateway and then connect to your App Service web app using Private Endpoint. Using this method you could block all public access to your web app.

Using Private Endpoints for App Service apps

https://learn.microsoft.com/en-us/azure/app-service/overview-private-endpoint

Remote work using Azure VPN Gateway Point-to-site

https://learn.microsoft.com/en-us/azure/vpn-gateway/work-remotely-support

Above approach involves additional monthly cost.

api.ipify.org this IP address is keeps on changing. Any solution for this ?

A: If your PC's public IP address changes frequently then you should contact your Internet Service Provider and request a static IP. This usually will increase monthly cost.

Please click Accept Answer and upvote to close up this thread.

Thanks.

TP 100.1K Reputation points

2023-10-27T04:18:22.5433333+00:00

@Elumalai, Vijayakumar Any update?

Vijayakumar Elumalai 105 Reputation points

2023-10-27T04:42:41.3666667+00:00

Enabled access restriction using Microsoft Entra ID based user access. Thanks so much for your inputs.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

IP access restriction rule not working in Azure web app.

0 additional answers

Your answer