Protecting a Site

Not every website should be open to the whole internet. rust-proxy gives you two ways to restrict who can reach a site, and you can use either one, both together, or neither. This page explains what each one does and, importantly, how they interact when you use both at once — this trips people up if it isn't explained clearly.

The two kinds of protection

1. Login required (username and password)

Visitors see a sign-in page before they can reach the site. You create one or more username/password pairs; anyone with valid credentials gets in.

2. Allowed networks only (by IP address)

Only visitors coming from specific networks or IP addresses can reach the site at all — everyone else is turned away before they see anything. Useful for things like an internal tool that should only be reachable from your office or home network.

Setting either one up

Both are managed from the ACLs tab (ACL stands for "Access Control List" — just a fancy name for "a list of who's allowed"):

Go to the ACLs tab and create a new list — choose either IP allow list or Login (username/password).
Add entries one at a time (an IP/network for an IP-allow list, or a username+password for a login list). You can add, edit, or remove individual entries later without recreating the whole list.
Go to the host you want to protect (Hosts tab → Edit) and, in the Access control section, select the list(s) you want applied to that host.

You can select more than one list of the same kind (any visitor matching any selected list gets in), and you can select both an IP-allow list and a login list on the same host at once — which brings us to the important part.

Using both at the same time: which one wins?

If a host has both an IP-allow list and a login list selected, here's exactly what happens:

Coming from an allowed network? You're let straight in — no login page at all.
Not coming from an allowed network, but you have valid login credentials? You still get in — you'll see the login page and can sign in normally.
Neither? You're shown an "Access denied" page.

In other words: matching the allowed-networks list is a shortcut past the login page, not an additional requirement on top of it. The two options work as alternatives ("let me in if I match either one"), not as a checklist you have to pass both of.

This matters in practice: if your source network ever changes (you're traveling, you switched ISPs, you're on a different Wi-Fi), you won't get locked out as long as you still know a valid username and password — the login page is always your fallback.

If you only set up an IP-allow list (no login list)

Then it behaves exactly like you'd expect on its own: matching networks get in, everyone else sees "Access denied," with no login page to fall back on. Add a login list to that same host any time you want a fallback option.

Removing protection

Go back to the host's Edit screen and deselect the list(s) in Access control. The site becomes reachable by anyone again as soon as you save.

Managing the lists themselves

The ACLs tab is also where you manage the lists' contents after creation — add a new allowed network or credential, edit an existing one, or remove one, all without needing to touch any host that uses the list. Changes take effect immediately for every host that has that list selected.

A related, but different, kind of restriction

The Opening Other Ports page covers a separate, firewall-level restriction for things that aren't regular websites (like remote-desktop tools or game servers) — those can also use an IP-allow list, but there's no login-page option for them, since they're not something a web browser talks to.