---
title: "EasySSO IP Filtering for NTLM and Kerberos"
canonical: "https://www.techtime-initiative.com/space/EasySSO/4096096/EasySSO%20IP%20Filtering%20for%20NTLM%20and%20Kerberos"
format: markdown
---
EasySSO supports both allowlists and blocklists to allow you to control which client machines will be permitted to use single sign-on.

> ℹ️ **Important:** The allowlist takes priority over the blocklist. This means if a client machine's IP matches both the allowlist and blocklist, then it'll be treated as allowlisted.

## Why do I need this?

If you have external users that don't use your internal AD, then you want to make sure to disable EasySSO for these users, as seamless SSO would fail and they would be prompted for username and password that would always fail.

For example, you would normally disable EasySSO on a guest WiFi, as it's very unlikely that the guests would be using your internal credentials.

EasySSO also needs to be disabled for automated solutions, for instance a wallboard reporting service, that uses a service account to authenticate itself.

If you are part of a large organisation with two sub-nets/divisions and if you didn't want to offer EasySSO to one, you can use filtering by IP sub-net.  For example, as a result of a merger, normally the separate domains would trust each other, and users from one domain would be allowed to access the services in another domain, and SSO will succeed. But if this is not the case IP Filtering will allow you to segment the network and offer SSO only to one domain.

## Filter client machines

### Step 1: Navigate to EasySSO Advanced Configuration

#### On EasySSO versions 4.0.0 and later

In the EasySSO configuration screen click NTLM/Kerberos. Click 'Advanced Configuration' on the top-right and switch to the 'IP Filtering Configuration' tab.

![image-20240828-011703.png](media://7b1dec28-713b-49ab-867d-11d360d6c13b)

#### On EasySSO versions prior to 4.0.0

In the EasySSO configuration screen switch to the "IP Filtering Configuration" tab.

![image-20240828-011803.png](media://c7737699-10e7-4ba2-a671-71706f0d1152)

### Step 2: Create IP or hostname based rules

Supports multiple rules, one per line. Enter individual IP, IP ranges, networks (CIDR notation) or hostnames.

![image-20240828-012038.png](media://efbb75cb-76c9-4f74-b4fc-5a002f0b97cf)

> ℹ️ **Important:** The allowlist takes priority over the blocklist. This means if a client machine's IP matches both the allowlist and blocklist, then it'll be treated as allowlisted.

#### DNS Refresh Interval / Host based filtering rules

For convenience, EasySSO allows hostnames to be specified in both allowlist and blocklist.  The actual filtering is done based on IP addresses, so EasySSO must look up the hostname in DNS before it can apply the filters.

EasySSO caches the results of the lookup to reduce the load on the DNS service and minimise delays associated with DNS lookups. The DNS Refresh Interval defines how long the EasySSO should rely on the cached entires before it updates them from DNS.

![image-20240828-012300.png](media://b2b23e8b-319b-49bc-b1aa-bddc74de15b7)

#### Reverse Proxy IP Address filtering rules

In a usual reverse proxy setup the proxy is configured to list the original client's IP address in the X-Forwarded-For HTTP header. EasySSO IP filtering allows you to filter (allowlist and blocklist) by the IP address of the client mentioned in the X-Forwarded-For HTTP header as well as by the IP address of the proxy. The cases of proxy being remote (located on another machine) and being local (located on the same machine) are both supported.

In a scenario with multiple proxies each subsequent proxy adds its client IP address to the comma-separated list in X-Forwarded-For header. EasySSO IP Filtering allows to filter by any of the listed IP addresses - if any IP address in the list matches the allowlist or the blocklist rule the request will be treated accordingly.

You only need to add the relevant IP address(es) to the allowlist or the blocklist in EasySSO IP Filtering tab. There is no additional configuration needed for this feature.