---
title: Network Restrictions for Organizations
description: Restrict access to your Capawesome Cloud organization by IP address or country. Set up an IP allowlist or country allowlist for your mobile team.
---

# Network Restrictions

Network restrictions limit which networks may reach your [organization](index.md). You can allow access from specific IP addresses and CIDR ranges, from specific countries, or both. Both restrictions are disabled by default.

## How Network Restrictions Work

The two restrictions are independent, and you can enable either one or both:

- **IP allowlist** — exact IPv4 and IPv6 addresses and CIDR ranges.
- **Country allowlist** — ISO 3166-1 alpha-2 country codes, such as `DE` or `US`.

If you enable both, a request must satisfy both to be allowed. An empty allowlist means that restriction is switched off.

Both restrictions fail closed. If a restriction is enabled and the IP address or country of a request cannot be determined, the request is denied. Requests coming from the Tor network never match a country allowlist.

!!! warning

    An IP allowlist and a country allowlist are not equally strong. An IP allowlist is a real perimeter. A country allowlist is a coarse filter that anyone can work around by renting a server in an allowed country. Don't rely on a country allowlist alone where you need a security boundary.

## What Is Restricted

Network restrictions apply to requests made with a session (the Console) and with an [API token](../accounts/tokens.md) (the CLI and the Cloud API). They also apply to SSO sign-in, and to accepting an invitation to the organization.

Members who are not part of the organization see the usual authorization error and are never told that the organization restricts access by network.

## Restricting Access by IP Address

1. Go to the **Settings** page in the [Capawesome Cloud Console](https://console.cloud.capawesome.io/organizations/_/settings){:target="_blank"}.
2. Scroll to the **Security** section.
3. Enable **Restrict access by IP address**.
4. Enter each IP address or CIDR range and press **Enter** after each one.
5. Click on the **Save** button.

![Security settings of an organization](../../assets/images/screenshots/cloud-organization-security-settings.png)

Both address families are supported, as single addresses or as CIDR ranges — for example `203.0.113.4`, `203.0.113.0/24`, `2001:db8::1`, or `2001:db8::/32`. You can add up to 250 entries.

To turn the restriction off again, disable **Restrict access by IP address** and save.

## Restricting Access by Country

1. Go to the **Settings** page in the [Capawesome Cloud Console](https://console.cloud.capawesome.io/organizations/_/settings){:target="_blank"}.
2. Scroll to the **Security** section.
3. Enable **Restrict access by country**.
4. Select each country you want to allow.
5. Click on the **Save** button.

You can add up to 250 countries. The country of a request is determined from its IP address, so a member connecting through a VPN or proxy in another country is treated as being in that country.

To turn the restriction off again, disable **Restrict access by country** and save.

## Avoiding Lockout

Because you are subject to your own allowlist, an allowlist that excludes you is rejected when you save it. Make sure your own IP address and country are covered before saving.

You can look them up on the [Sessions](https://console.cloud.capawesome.io/settings/sessions){:target="_blank"} page, which shows the IP address and country of your current session. The Console links to it from both fields.

Keep in mind that this protects only you. Other members, and any automation using an API token, can still be locked out by an allowlist that doesn't cover them. Before you save, consider:

- **Members working remotely or from other offices.** Home connections usually have dynamic IP addresses that change without notice.
- **CI/CD pipelines.** A pipeline running on GitHub Actions, GitLab CI, or a similar hosted runner authenticates with an [API token](../accounts/tokens.md) and is subject to the IP allowlist. Either allowlist your provider's egress ranges, or use Capawesome-hosted builds, which are not restricted.
- **Members travelling abroad**, if you use a country allowlist.

## Regaining Access

If everyone with permission to change the settings ends up outside the allowlist, the restriction can no longer be lifted from the Console — the check runs before the request reaches the settings. In that case, [contact Capawesome support](../../support/index.md) to have the restriction removed.

## Next Steps

- [Roles & permissions](roles-and-permissions.md) — control what each member can do.
- [Two-factor enforcement](two-factor-authentication.md) — require 2FA for members.
- [Single sign-on (SSO)](sso/index.md) — enforce SSO for your members.
- [Audit logs](audit-logs.md) — review actions across the organization.