IP Restrictions

IP Restrictions let you decide which networks can use your Paminga Instance. You keep an Allow List, a Block List, or both, and Paminga checks them on every request. A person who signs in at the office and then opens a laptop at a coffee shop is stopped on their next click, not at their next sign-in.

note

If you do not see IP Restrictions under Users & Security, contact your Paminga representative. You also need permission to change your Login Security Policy.

How the Lists Work

Paminga applies one rule, in this order:

1. If the IP Address is on the Block List, access is denied.
2. If the Allow List is empty, access is allowed.
3. If the IP Address is on the Allow List, access is allowed. Otherwise it is denied.

So the two lists do different jobs.

• An Allow List is the strong control. Only the networks you name get in. This is what you want if your people work from offices or a VPN with fixed IP Addresses.
• A Block List alone is weaker. Everyone gets in except the addresses you name, and a blocked person can change networks.
• Together, the Block List carves a range out of the Allow List. For example, allow your corporate range and block its guest Wi-Fi.

Set Up Your Lists

Each entry is one IP Address or a CIDR range, such as 203.0.113.42 or 203.0.113.0/24. Give it a Label so the next admin knows what it is.

Add your entries first, then turn on Restrict Access by IP Address. Nothing is enforced until you do, so you can add every office before anyone is affected. Turning the switch on or off can take up to 2 minutes to reach people who are already signed in. Changes to the lists apply on the next request once restrictions are on.

Add Your IPv6 Ranges

Paminga accepts connections over IPv6 as well as IPv4. If your network uses both, add both, or people may be denied on the IPv6 side. The IP Restrictions page shows your current IP Address, and whether your lists allow it.

Paminga Will Not Let You Block Yourself

If a change would block the IP Address you are using, Paminga refuses it and tells you why. This applies when you turn on restrictions, and when you add, edit, or delete an entry while they are on.

If your network changes and everyone is locked out, contact Paminga support. Paminga staff can correct your lists.

What the Restrictions Cover

Restrictions apply to every way a person signs in, including password, passkey, Google, Microsoft, Salesforce, and Okta. They also apply to the Paminga mobile app, so a phone on a cellular network is denied unless its network is on your Allow List.

API Tokens and Connectors

Apply to API Tokens and Connectors decides whether the lists also cover personal access tokens, OAuth Apps, Zapier, and hosted AI assistants. It is on by default.

A hosted tool connects from its own vendor's IP Addresses, not yours. Turn this off if you use one and cannot add its addresses to your Allow List.

What Is Not Restricted

• Your public Forms, Landing Pages, and tracking. Your Contacts are not on your network, and they do not need to be.
• SCIM provisioning from Okta, which uses its own token.
• Paminga staff, including support sessions. This is how we help you if you are locked out.