configs/ip_allow.yaml.default

# YAML
#
# ip_allow.yaml
#
# Documentation:
#    https://docs.trafficserver.apache.org/en/latest/admin-guide/files/ip_allow.yaml.en.html
#
# Rules:
# Each rule is a mapping, with the tags
#
#   apply: Either "in" or "out" to apply to inbound and outbound connections respectively.
#   ip_addrs: IP address ranges, either a single range or a list of ranges.
#   action: "allow" or "deny"
#   methods: A method name or sequence of method names. Available methods: GET, CONNECT, DELETE,
#            HEAD, OPTIONS, POST, PURGE, PUT, TRACE, PUSH. The special name "ALL" indicates all
#            methods and it overrides any other methods.
#
# A rule must have either "src" or "dst" to indicate if the IP addresses apply to inbound connections
# or outbound connections.
#
# The top level tag 'ip_allow' identifies the rule items. Its value must be a rule item or a
# sequence of rule items.
#
# Rules are applied in the order listed starting from the top. The first
# matching IP range determines the rule used for that connection, so add
# explicit exceptions before broader deny rules.
#
# Allow anything on localhost, limit destructive and debug methods elsewhere.
ip_allow:
  - apply: in
    ip_addrs: 127.0.0.1
    action: allow
    methods: ALL
  - apply: in
    ip_addrs: ::1
    action: allow
    methods: ALL
  - apply: in
    ip_addrs: 0/0
    action: deny
    methods:
      - PURGE
      - PUSH
      - DELETE
      - TRACE
  - apply: in
    ip_addrs: ::/0
    action: deny
    methods:
      - PURGE
      - PUSH
      - DELETE
      - TRACE
  # Deny CONNECT tunnels to unspecified, loopback, private, and link-local
  # destination addresses by default. If you intentionally proxy CONNECT to
  # one of these ranges, add a more specific outbound allow rule before this
  # one.
  - apply: out
    ip_addrs:
      - 0.0.0.0/8
      - 127.0.0.0/8
      - "::"
      - ::1
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::/96
      - fc00::/7
      - fe80::/10
      # IPv4-compatible IPv6 ranges use ::/96. IPv4-mapped IPv6 ranges use
      # hexadecimal notation because the range parser does not accept
      # embedded dotted-quad tails.
      - ::ffff:0:0/96
    action: deny
    methods: CONNECT