Skip to main content
Bahasa Indonesia 日本語 ไทย Tiếng Việt

Configure IP Address Restriction

  • Updated

This feature allows you to permit access only from specific IP addresses (or IP address ranges) and deny all other access. By restricting access to company networks, offices, VPN connections, or other predetermined routes, you can greatly enhance security.

Dive supports restriction by global IP addresses (IPv4/IPv6) in three formats: single address, range, and CIDR. After configuration, logins from IP addresses not on the allowlist are blocked, even for users with Owner permissions. With the Enterprise plan, you can also configure access from networks outside the allowlist to be permitted only when multi-factor authentication (MFA) is successful (see "Permit access from outside the allowlist with multi-factor authentication" below).

Who can configure this

Only users with Owner permissions can configure this.

Things to check before you start

This is a powerful restriction. There is a risk that even the Owner may be locked out due to misconfiguration, so please check the following:

  • Confirm that the IP address you are configuring is a global IP (the outbound IP assigned by your provider or VPN)
  • Before configuring, always include your own global IP
  • It is recommended that you export to Excel to keep a backup copy of the allowed IP addresses so you can verify them immediately after configuration

If you are locked out of your account, please contact Dive support (customer-success@episotech.com).

Configuration steps

  1. Log in to Dive and click "Owner Functions"
  2. Select the "Security" tab at the top and open the "IP Address Restriction Settings" card

  3. Check the box for "Use IP address restriction"

  4. Open the allowlist section and click one of the following depending on the format you want to register:
    • "+ Add": Register a single IP address or CIDR format (for example: 192.168.0.0/24)
    • "+ Add by range": Register a range from start IP to end IP

  5. Enter the IP addresses you want to allow (supports the following three formats)

    • Single IP: 203.0.113.5 / 2001:db8::1
    • Range: 203.0.113.5 ~ 203.0.113.50
    • CIDR: 192.168.0.0/24 / 2001:db8::/32

    If you enter an invalid format, you will see a red error message immediately

  6. When done, click "Save"

Safety during save

When you save, if the network used by your current session (the IP you are accessing from right now) is not on the allowlist, the following message will appear. It will be added automatically, so click "OK". This prevents you from being locked out immediately after configuration.

If you have enabled the multi-factor authentication exception described below and you are included in its scope, this message will not appear. Since you can reconnect using the exception, the allowlist will not be changed.

Permit access from outside the allowlist with multi-factor authentication

If you need to use Dive from networks not on the allowlist, such as during business trips or on mobile networks, you can permit access on the condition that multi-factor authentication (MFA) has been successfully completed. By default this is disabled, and behavior does not change until you enable it.

Even if you enable this setting, the list of allowed IP addresses will not change. Access from permitted networks remains the same as before. Only access from other networks changes.

  • From permitted networks: Access is permitted regardless of whether this setting is enabled or disabled
  • From other networks: If disabled, access is not permitted. If enabled, only target users who have set up multi-factor authentication can access

Available plans

This feature is available with the Enterprise plan. Only users with Owner permissions can configure it.

Configuration steps

  1. Open "Owner Functions" and open the "IP Address Restriction Settings" card from the "Security" tab at the top
  2. Confirm that "Use IP address restriction" is enabled (if IP address restriction is disabled, this setting has no meaning)
  3. Check the box for "Permit access when multi-factor authentication (MFA) is successful for access from outside the permitted network". A confirmation message will appear; check the contents and click "OK"
  4. In "Target Users", select the users you want to permit. If you want to permit all users, check "Permit all users who have set up multi-factor authentication without limiting targets"
  5. Click "Save"

If you do not specify any target users and do not check "Permit all users who have set up multi-factor authentication without limiting targets," this setting will not apply to anyone (no one from outside the permitted network can use Dive). A warning will also be displayed on the configuration screen.

If you uncheck "Use IP address restriction," this setting is also disabled at the same time. This prevents the inadvertent opening of access from outside the permitted network when you re-enable IP address restriction.

Login methods included

Only users who log in with an email address and password and have set up multi-factor authentication are included. The following login methods are not included, and users outside the permitted network cannot use them as before.

  • Users who log in via single sign-on (Microsoft Entra ID / SAML): Identity verification at login is performed by the IdP, so Dive cannot verify multi-factor authentication success
  • Email-free account (users who log in with an ID issued by an administrator): This is because it is designed for use on shared devices
  • Smart glass QR code login

Preparation by users

Target users must complete multi-factor authentication registration in advance. Register while connected to the permitted network. For instructions, see Two-factor authentication (personal setup).

If you operate across your entire team, also consider using Two-factor authentication (MFA) mandatory for entire team together. This setting works even if not mandatory. Users who have not registered multi-factor authentication can simply not access from outside the permitted network.

Messages when login fails

  • "IP address restriction: You cannot use the network you are currently connected to": This setting is disabled. Connect from a permitted network
  • "To use from outside the permitted network, multi-factor authentication setup is required. Connect to the permitted network and set it up": You are a target user, but multi-factor authentication has not been registered yet
  • "You are not permitted to use from outside the permitted network. Check with your administrator": You are not included in the target users. Ask the Owner to add you
  • "With this login method, you cannot use from outside the permitted network": This login method is not eligible (single sign-on, email-free accounts, etc.)

Checking logs

Changes to settings and records of permitting or denying login from outside the permitted network based on this setting are retained in the audit log. You can see who accessed from which IP address and when (see Export audit log to CSV).

Excel import and export

You can also manage the list of permitted IPs in bulk with Excel. Even if your organization manages many offices and VPNs, you can register a list prepared in Excel as-is.

  • "Export to Excel": Download the current allowlist as an Excel file
  • "Excel import": Import the allowlist from an Excel file (.xlsx)

You can also use this when you want to keep a backup due to operational changes or for audit purposes.

Tips for effective use

  • Always test before production deployment: Save with a minimal configuration that includes your own global IP, and verify from logout to re-login
  • Enforce VPN access: Effective when you want to prevent direct access from home or cafes and require login via VPN
  • When expanding offices: When you have a new office, add its global IP to the allowlist before operations begin
  • IPv6 mixed environment: Some providers mix IPv4 and IPv6. Permitting both in the allowlist is safe

Related

Was this article helpful?
0 out of 0 found this helpful
Return to top

Related articles