Skip to main content

IP Allow List

The IP Allow List restricts access to a Nexus Repository instance based on specific IP addresses or CIDR ranges. It adds a network-level control to ensure that only approved locations can access the system.

This feature is available in:

  • Nexus Repository Pro

  • Nexus Repository Cloud

  • Nexus One UI only; not available in Classic UI

Use the IP Allow List to:

  • Limit access to trusted networks

  • Reduce exposure to unauthorized requests

  • Add an additional layer of security beyond authentication and authorization

How IP Filtering Works

The IP Allow List evaluates each incoming request against configured entries. Based on the active filtering mode, the request is either allowed, monitored, or blocked.

Filtering Modes

Disabled (default)

  • No IP filtering is applied

  • All requests are allowed

Monitor

  • Requests are evaluated against the allow list

  • Requests from non-allowed IPs are allowed

  • Events are recorded in the audit log

Enforce

  • Only requests from allowed IPs are permitted

  • Non-matching requests are blocked with HTTP 403 (Forbidden)

  • Blocked requests are recorded in the audit log

Note

Start with Monitor mode to validate your configuration before switching to Enforce.

Configure the IP Allow List

Ensure you have administrative access to Nexus Repository and that you are using the Nexus One UI as this feature is not available in the Classic UI.

Identify the IP addresses or CIDR ranges that require access.

  1. Navigate to Settings (cog icon) > Security > IP Allow List.

  2. Choose a filtering mode:

    • Disabled – No IP filtering is applied

    • Monitor – Log requests without blocking

    • Enforce – Block requests from unlisted IPs

  3. Changes are saved automatically.

The selected filtering mode is applied. Requests are evaluated according to the configured mode.

Note

Only users with administrator privileges can access and configure the IP Allow List settings in Nexus Repository.

Manage Allow List Entries

You can add, update, or remove entries using the UI or REST API.

Supported Entry Types and Limitations

  • IPv4 address (for example, 192.168.1.10)

  • IPv6 address (for example, 2001:db8::1)

  • CIDR range (for example, 10.0.0.0/8, 2001:db8::/32)

  • Supports a maximum of 256 entries by default.

Manually Add a New IP Allow List Entry

To add a new entry:

  1. Navigate to Settings (cog icon) > Security > IP Alow List.

  2. Select the IP Allow List tab.

  3. Select Add Entry.

  4. Enter the IP Address and, optionally, add a Description.

  5. Select Add IP Address.

Edit Existing IP Allow List Entries

  1. Navigate to Settings (cog icon) > Security > IP Allow List.

  2. Select the IP Allow List tab.

  3. Locate the entry you wish to edit; select the three-dot icon for that line.

  4. Select Edit from the menu.

  5. Make your desired changes; then, select Save Changes.

Delete an Entry

  1. Navigate to Settings (cog icon) > Security > IP Allow List.

  2. Select the IP Allow List tab.

  3. Either select the three-dot icon beside a single entry or select checkboxes next to multiple entries you wish to delete. You can also select all entries by selecting the checkbox in the header of the table that lists IP Addresses.

  4. Select Delete; then, confirm deletion in the confirmation modal.

Import Entries in Bulk

You can upload multiple entries using a CSV file.

Prerequisites

  • One IP address or CIDR range per line

  • Maximum file size: 1 MB

Use the following steps to import entries in bulk.

  1. Click the Import Entry button.

  2. Drag and drop a CSV file or select a file.

  3. Submit the file.

After processing, the system displays:

  • Successfully added entries

  • Duplicate entries (skipped automatically)

  • Invalid entries with error details

Duplicate entries are ignored, allowing repeated uploads without duplication.

Exempt Addresses and Endpoints

To prevent accidental lockouts, certain addresses and endpoints are always allowed.

Always allowed IPs

  • 127.0.0.1 (IPv4 localhost)

  • ::1 (IPv6 localhost)

Always accessible endpoints

  • /service/rest/v1/status

  • /healthcheck

Audit Log Events

All IP Allow List activity is recorded in the audit log.

Events

  • Configuration changes (add, edit, remove entries; mode changes)

  • Request evaluations:

    • Monitored requests (Monitor mode)

    • Blocked requests (Enforce mode)

Logged details

  • Source IP address

  • Requested path

  • Timestamp

  • Active filtering mode

Note

Monitor mode can generate high log volume in high-traffic environments.

REST API

You can manage the IP Allow List using the REST API.

Endpoint

/v1/security/ip-allowlist

Supported operations

  • List entries (paginated and searchable)

  • Add or edit entries

  • Bulk add or delete entries

  • Upload CSV files

  • Change filtering mode

  • Clear all entries

  • Retrieve current client IP

The REST API is available regardless of the UI version.

Limitations

  • Applies at the application level only (not per repository)

  • Supports allow list only, deny lists are not supported.

  • Not support for:

    • Time-based rules

    • User or role-based exceptions

    • Hostnames or DNS-based filtering

  • Not available in OSS/Core edition

  • Classic UI does not include configuration page

  • In HA deployments:

    • Up to 15 seconds delay for changes to propagate across nodes

  • Supports a maximum of 256 entries by default.