# 4.1 BlackList & WhiteList
#### π§ Overview
The **BlackList & WhiteList** module in ShieldsGuard gives administrators the power to allow or block specific IP addresses from accessing the protected website or application. This forms the most fundamental and direct layer of access control in your security policy.
With this module, traffic can be explicitly permitted (whitelisted) or denied (blacklisted), regardless of WAF, DDoS, or any other protection mechanisms in place.
***
#### β Allowed IP Addresses (Whitelist)
This section allows you to define IPs or ranges that should **bypass all protection engines** β including:
* Web Application Firewall (WAF)
* DDoS Protection
* Rate Limiting
* Behavior-based Blocking
**Use Cases:**
* Trusted internal IPs (corporate office, VPNs)
* Monitoring systems or uptime checkers
* Developers or testers who should never be blocked
* Third-party services with known IPs (e.g., Stripe, PayPal, Cloud providers)
**Example:**
```
203.0.113.42
10.10.0.0/16
```
> β οΈ Whitelisted IPs are treated as **fully trusted** β ensure they are secure and properly scoped.
***
#### π« Blocked IP Addresses (Blacklist)
This section allows you to **completely ban IPs or ranges** from accessing the site. Any request from a blacklisted IP will be dropped immediately.
**Use Cases:**
* Known malicious actors
* Repeated brute-force or spam sources
* IPs flagged by threat intelligence
* Abuse reports or geo-blocking by range
**Example:**
```
192.168.100.23
203.0.113.0/24
```
> π Blacklist takes absolute precedence β blocked IPs cannot bypass via any other setting.
***
#### π§ How to Use
1. Go to **Security Rules > BlackList & WhiteList**
2. Switch between **Allowed IP Addresses** or **Blocked IP Addresses**
3. Click βAdd IP Addressβ
4. Enter:
* Single IP (e.g., `192.0.2.10`)
* IP Range / CIDR (e.g., `192.0.2.0/24`)
5. Save
Changes take effect immediately and will be logged in traffic analytics.
***
#### π Search and Manage
* You can **search** IPs using the search bar
* Use **bulk selection** for mass deletion or editing
* Logs will indicate whether a request was blocked or allowed due to IP rule
***
#### π Best Practices
| Situation | Recommendation |
| -------------------------- | ------------------------------------ |
| Allow internal staff | Whitelist static corporate IPs |
| Prevent botnets & scrapers | Use blacklists with CIDR blocks |
| Integrate threat feeds | Automate blacklist entries via API |
| Avoid accidental lockout | Whitelist your own IP before testing |
***
> π‘οΈ IP-level control is your first line of defense. Use it to allow what you trust, and block what you know to be harmful.
