Plan requirement
| Subscription | Any plan |
| Access | Admin |
Allowing sign-ins only from addresses you list. It blocks the API as well, and customers too unless you tick one box, which is the part that catches people out.
Set it up
- Collect every address range that legitimately reaches your account: offices, the VPN, fixed home connections, sites abroad, and the external addresses of every integration that uses the API.
- In Admin Center, click Account in the sidebar, then select Security > Advanced and open the IP restrictions tab.
- Enter the addresses in Allowed IP Ranges, separated by spaces.
- Decide whether to tick Allow customers to bypass IP restrictions.
- Select Enable IP restrictions and save.
Step one is the work. The setting itself takes a minute, and a range you forgot is a colleague who cannot sign in on Monday.
How to write the ranges
Two notations are accepted. A wildcard replaces a whole number group, so 192.*.*.* allows every address starting with 192. A CIDR mask works too, so 192.168.1.0/25 covers 192.168.1.0 to 192.168.1.127.
A CIDR value of 0 is rejected, so 10.0.0.0/0 is not a way to allow everything.
It blocks the API as well
Any attempt to sign in, call the API or open a page in any Zendesk product fails from outside your allowed addresses. That is why third-party integrations break: they call from their own address, not from your office.
List every one of those addresses before you enable the setting. The symptom otherwise is an integration that mysteriously stops working, with nothing in it pointing at this page.
Customers are blocked unless you say otherwise
Allow customers to bypass IP restrictions lets your customers reach the help centre and messaging channels from any address. Without it they are restricted like everybody else, and a public help centre becomes reachable only from your own offices.
Agents and administrators can never bypass the restriction, whatever that box is set to.
Do not lock yourself out
Zendesk documents no self-service recovery for this. Test from your own connection first, keep a second admin who can reach the account, and if it does happen, contact pluscloud support rather than working through it alone.
Home and mobile working is the other constraint: most home connections change address, so unless everybody arrives through the VPN, sort the VPN out first. Then review the list whenever an office, a VPN or a provider's range changes.
Comments
0 comments
Article is closed for comments.