# How to 'whitelist' IP address's that can access Node RED

**URL:** <https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990>\
**Category:** FAQs\
**Tags:** security\
**Created:** [23 December 2023 16:58 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990 "2023-12-23T16:58:59Z")\
**Posts on this page:** 9\
**Page:** 2

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [28 December 2023 17:39 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990/21 "2023-12-28T17:39:27Z")

</div>

This is just "a way" to make it more secure, and it truly isn't "The Way".  
But in answer to your question, this modification will also protect the dashboard, as it uses the Admin API.

See below (Error 401) - suggesting the dashboard is using the Admin Express Endpoint

 ![Screenshot 2023-12-28 at 17.40.41](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/a/4/a4754d9a1e29bf6df8b5f0fea288da8dc731b986.png)

---

<div class="post-metadata">

**Author:** ![shrickus](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/shrickus/32/517_2.png) [@shrickus](https://discourse.nodered.org/u/shrickus)\
**Post date:** [6 January 2024 20:37 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990/22 "2024-01-06T20:37:03Z")

</div>

> [@zenofmud](#):
>
> Note that if putting the IP's in a separate file, comments are not allowed

Instead of just "including" the list of addrs from a JSON file, you can make a proper Javascript module, i.e. this simple `whitelist.js` file:

```javascript

// Allowed ip addresses
const whitelist = [
  "127.0.0.1", /* Localhost */
  "192.168.1.0/24" /* Private Network */
]

module.exports = whitelist

```

Then you can use `require` in your settings.js like you did before...

```auto
> const ipAddrs = require("./whitelist")
['127.0.0.1', '192.168.1.0/24']

```

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [6 January 2024 20:47 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990/23 "2024-01-06T20:47:43Z")

</div>

Indeed!

How the whitelist (`blocklist` in reverse) is fed the IP's - is entirely variable

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [6 January 2024 22:48 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990/24 "2024-01-06T22:48:07Z")

</div>

To use a whitelist... do you need to block all other IP's that are not in the whitelist?

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [6 January 2024 22:50 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990/25 "2024-01-06T22:50:14Z")

</div>

Nope.

The check is -\> **is this IP in the allowed list, if not... Do One!**

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [6 January 2024 22:56 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990/26 "2024-01-06T22:56:03Z")

</div>

The Node JS `blocklist` should be used as follows

```auto
if(BlockList.check(<ip>)){
   // Do One!!
} else {
   // Allow
}

```

I'm just reversing it

```auto
if(BlockList.check(<ip>)){
   // Allow
} else {
   // Do One (401)
}

```

its a shame they call it a block list for this use case.  
In theory you could switch it - but will likely be less effective

---

<div class="post-metadata">

**Author:** ![ptweety](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ptweety/32/68053_2.png) [@ptweety](https://discourse.nodered.org/u/ptweety)\
**Post date:** [12 January 2024 11:25 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990/27 "2024-01-12T11:25:00Z")

</div>

Hi all,

I like this discussion. But one thing that stands out to me is, that you only talk about IPV4.

Don’t forget the ever growing other part of the internet: IPV6 😉

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [12 January 2024 12:26 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990/28 "2024-01-12T12:26:45Z")

</div>

It does support IPv6

Just have to modify the code to state it’s an IPV6 address

If you refer to the NodeJS blocklist class, the code will need modifying so it knows when to state it’s an IPv6s address.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [12 January 2024 14:18 UTC](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990/29 "2024-01-12T14:18:20Z")

</div>

I have updated the security FAQ with references to Node.js security best practices, the blocklist functions and this thread.

> [@Safely accessing Node-RED over the Internet](https://discourse.nodered.org/t/safely-accessing-node-red-over-the-internet/45024):
>
> Update 2025-02-19 The best advice for most people doing home automation is still: Don't expose Node-RED to the outside world! Where you really have to have some outside access, keep it as hands-off and restricted as possible. For example, using a Telegram bot. Also keep it as minimal as possible, e.g. Don't expose the Editor - EVER! If you want to provide remote control of your heating or the precious plants in your greenhouse, provide explicit controls with strong limits. Don't expose ever…

[Previous page](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990.md?page=1)