The Access Restrictions page allows administrators to control platform access based on the geographic location and source IP address of incoming requests. These restrictions are configured at the tenant level and are enforced before requests reach the application whenever possible.
Important!
When both country restrictions and IP CIDR range restrictions are configured, both restrictions are applied together. A request must satisfy all configured rules to be allowed.
Note
Country-based filtering relies on IP geolocation data and is performed on a best-effort basis. Geolocation information may not always precisely reflect a user's actual physical location.
Use this page to configure:
Geographic access restrictions by country
IP address and IP range restrictions
Tenant-specific access control policies
Geofenced Countries
Use the Geofenced Countries section to control access based on the country associated with a user's source IP address.
Note
Geofenced countries must be maintained by the tenant admin. The Syniti Knowledge Platform does not block countries by default.
Configure Country Restrictions
In the Select countries field, choose one or more countries.
Click Save.
The platform evaluates the request's source IP address and determines the country using IP geolocation data. Users connecting from the selected countries are denied, while all other countries may proceed.
IP CIDR Range Restrictions
Use the IP CIDR Range Restrictions section to restrict access by specific IP addresses or IP address ranges.
Add an IP Range
Enter a valid IP address or CIDR range.
Example:
192.168.1.0/24
Click Add range.
Repeat as needed for additional entries.
Click Save.
Requests originating from configured IP addresses or ranges are blocked.
If no IP addresses or ranges are configured, IP-based filtering is not applied and requests from all IP addresses are allowed.
Supported Formats
The SKP supports:
Individual IPv4 addresses
Individual IPv6 addresses
IPv4 CIDR ranges
IPv6 CIDR ranges
Examples:
192.168.1.25192.168.1.0/2410.0.0.0/82001:db8::/32
How Access Decisions Are Evaluated
Access restrictions are evaluated using the request's source IP address.
The platform determines:
The client source IP address.
The country associated with the IP address.
Whether the request matches configured country policies.
Whether the request matches configured IP address or IP range policies.
Whether the request should be allowed or denied.
Source IP information is obtained from trusted request headers such as X-Forwarded-For when requests pass through load balancers, proxies, or gateways.
When Both Restriction Types Are Configured
A request must satisfy both configured policies.
Country Rule Result | IP Rule Result | Outcome |
|---|---|---|
Allowed | Allowed | Access Granted |
Allowed | Denied | Access Denied |
Denied | Allowed | Access Denied |
Denied | Denied | Access Denied |
Request Blocking
Disallowed requests are blocked as early as possible in the request processing flow, typically at the network edge or API gateway layer.
This approach helps:
Reduce unnecessary processing
Improve security posture
Enforce tenant access policies consistently
Prevent unauthorized access attempts from reaching application services
Best Practices
Review country and IP restrictions regularly.
Validate IP ranges before saving changes.
Test changes carefully to avoid unintentionally blocking authorized users.
Remember that geolocation data may vary between providers and can change over time.