Protecting a Site

Updated Oct 27, 2026

Not every website should be open to the whole internet. RustProxy gives you several ways to control who can reach a site, and you can combine them. This page covers the two most common, then points to the others. This page explains what each one does and, importantly, how they interact when you use both at once — this trips people up if it isn't explained clearly.

The two common kinds of protection

1. Login required (username and password)

Visitors see a sign-in page before they can reach the site. You create one or more username/password pairs; anyone with valid credentials gets in.

2. Allowed networks only (by IP address)

Only visitors coming from specific networks or IP addresses can reach the site at all — everyone else is turned away before they see anything. Useful for things like an internal tool that should only be reachable from your office or home network.

Setting either one up

Both are managed from the Access lists tab (ACL stands for "Access Control List" — just a fancy name for "a list of who's allowed"):

1. Go to the Access lists tab and create a new list — choose either IP allow list or Login (username/password).
2. Add entries one at a time (an IP/network for an IP-allow list, or a username+password for a login list). You can add, edit, or remove individual entries later without recreating the whole list.
3. Go to the site you want to protect (Sites, Hosts, then Edit) and, in the Who can visit section, select the list(s) you want applied to that site.

You can select more than one list of the same kind (any visitor matching any selected list gets in), and you can select both an IP-allow list and a login list on the same host at once — which brings us to the important part.

Using both at the same time: which one wins?

If a host has both an IP-allow list and a login list selected, here's exactly what happens:

• Coming from an allowed network? You're let straight in — no login page at all.
• Not coming from an allowed network, but you have valid login credentials? You still get in — you'll see the login page and can sign in normally.
• Neither? You're shown an "Access denied" page.

In other words: matching the allowed-networks list is a shortcut past the login page, not an additional requirement on top of it. The two options work as alternatives ("let me in if I match either one"), not as a checklist you have to pass both of.

This matters in practice: if your source network ever changes (you're traveling, you switched ISPs, you're on a different Wi-Fi), you won't get locked out as long as you still know a valid username and password — the login page is always your fallback.

If you only set up an IP-allow list (no login list)

Then it behaves exactly like you'd expect on its own: matching networks get in, everyone else sees "Access denied," with no login page to fall back on. Add a login list to that same host any time you want a fallback option.

Mobile passes

An allowed-networks list is great until you're away from those networks. Mobile passes let your phone in from anywhere while the RustProxy Mobile Pass app is switched on.

1. Turn them on under Network, then Mobile passes.
2. Create a Login list with the username and password the phone will sign in with.
3. Open the IP-allow list (Network, Access lists, Manage entries) and pick that login list under Mobile pass logins.
4. Sign in to the app on your phone and switch it on.

While the app is on, your phone's current address counts as inside the allow list. It checks in about every 30 seconds; if the phone goes offline, changes networks, or the app is switched off, its old address drops out within 90 seconds or at once. RustProxy always uses the address it sees the phone connecting from, so the phone can't claim a different one.

By default a pass opens only websites. To let it open port rules too (SSH, remote desktop), tick Also open port rules and hosted ports on the same list; see Opening Other Ports.

Keep the site's own sign-in on as well: on cellular many people share the same public address, and anyone on it is let in while your pass is live.

Two more kinds

• Block lists keep certain visitors out: single addresses, ranges, or a whole network operator by its AS number. They can apply to one site or to everything, and a block always beats an allow. See Blocking Visitors.
• Client certificates let people on a trusted device in without typing a password. See Client Certificates.

Both work alongside the two above, with one rule: a block always wins. A visitor on a block list is turned away even if they'd otherwise get in.

Removing protection

Go back to the site's Edit screen and deselect the list(s) in Who can visit. The site becomes reachable by anyone again as soon as you save.

Managing the lists themselves

Network, then Access lists, is also where you manage the lists' contents after creation — add a new allowed network or credential, edit an existing one, or remove one, all without needing to touch any host that uses the list. Changes take effect immediately for every host that has that list selected.

A related, but different, kind of restriction

The Opening Other Ports page covers a separate, firewall-level restriction for things that aren't regular websites (like remote-desktop tools or game servers) — those can also use an IP-allow list, but there's no login-page option for them, since they're not something a web browser talks to.