# Restricting URLs to an IP range

**URL:** <https://discourse.haproxy.org/t/restricting-urls-to-an-ip-range/9166>\
**Category:** Help!\
**Created:** [October 25, 2023, 8:13pm UTC](https://discourse.haproxy.org/t/restricting-urls-to-an-ip-range/9166 "2023-10-25T20:13:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![flea](https://avatars.discourse-cdn.com/v4/letter/f/d78d45/32.png) [@flea](https://discourse.haproxy.org/u/flea)\
**Post date:** [October 25, 2023, 8:13pm UTC](https://discourse.haproxy.org/t/restricting-urls-to-an-ip-range/9166/1 "2023-10-25T20:13:27Z")

</div>

Hey folks,

I’ve got three web servers balanced by two HAProxy servers that all need to be accessible to anyone on the internet. There’s an admin login page at a separate URL (essentially [cloud.domain.com](http://cloud.domain.com) and [cloud.domain.com/admin](http://cloud.domain.com/admin)). I’d like that admin page only accessible by people on-prem or on our VPN (basically anyone with a 10._._.\* address) to increase security.

I tried setting that to be true from the web servers themselves, but since all the connections are being made by the HAProxy servers (which sit on the 10._._.\* subnet), it just passes all traffic along.

Has anyone had any experience with this? Thank you in advance 🙂

---

<div class="post-metadata">

**Author:** ![randomguy](https://avatars.discourse-cdn.com/v4/letter/r/ba8739/32.png) [@randomguy](https://discourse.haproxy.org/u/randomguy)\
**Post date:** [October 25, 2023, 9:05pm UTC](https://discourse.haproxy.org/t/restricting-urls-to-an-ip-range/9166/2 "2023-10-25T21:05:47Z")

</div>

You should be able to use something like this. This is only based on the uri but you can write another acl to check the hostname if needed.

```auto
http-request deny if { path -i -m beg /admin } !{ src -f /etc/hapee-2.8/whitelist.lst }

```

```auto
:/etc/hapee-2.8$ cat /etc/hapee-2.8/whitelist.lst
17.1.1.1/32
17.1.1.2/32
1.1.0.0/16

```

---

<div class="post-metadata">

**Author:** ![flea](https://avatars.discourse-cdn.com/v4/letter/f/d78d45/32.png) [@flea](https://discourse.haproxy.org/u/flea)\
**Post date:** [October 25, 2023, 10:31pm UTC](https://discourse.haproxy.org/t/restricting-urls-to-an-ip-range/9166/3 "2023-10-25T22:31:19Z")

</div>

That’s worked perfectly, thank you so much!