---
title: "Limit access to the load balancer"
sidebar_label: "Limit access to the load balancer"
sidebar_position: 5
description: "How to limit access to the load balancer from IP addresses"
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import CheckIcon from '@selectel/docux/icons/check'
import EditIcon from '@selectel/docux/icons/edit'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Limit access to the load balancer

You can limit access to the load balancer by specifying allowed IP addresses from which the load balancer will accept traffic.

Allowed IP addresses are specified in the load balancer [rule](/cloud-servers/load-balancers/about-load-balancers.mdx#rules) and apply only to the port and traffic type specified in the rule. You can specify allowed addresses when [creating a rule](/cloud-servers/security-groups/manage-rules/create-rule.mdx) or in an [existing rule](#specify-allowed-cidrs-in-rule).

For allowed addresses to work, [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)) must be enabled in the load balancer network.

## Specify allowed IP addresses in an existing rule \{#specify-allowed-cidrs-in-rule}

<Tabs queryString="specify-allowed-cidrs-in-rule">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [Control panel](https://my.selectel.ru/vpc/default/lbaas/load-balancers/), on the top menu, click **Products** and select **Cloud Servers**.

    2. Go to the **Load balancers** section → **Load balancers** tab.

    3. Open the load balancer page.

    4. Open the rule card.

    5. If the card contains the **Allowed CIDR** field, in this field:

       5.1. Click <EditIcon />.

       5.2. Enter the allowed IP addresses or subnets separated by commas.

       5.3. Click <CheckIcon />.

    6. If the **Allowed CIDRs** field is not displayed, traffic filtering (port security) is disabled in the network [traffic filtering (port security](/cloud-servers/cloud-networks/about-networks.mdx#traffic-filtering-port-security)). [Create a new private network](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#create-private-network) or [public subnet](/cloud-servers/cloud-networks/public-subnets.mdx#create-public-subnet) and [recreate the load balancer in it](/cloud-servers/load-balancers/create-load-balancer.mdx).
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Open OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    2. Make sure that traffic filtering is enabled in the balancer network — the `port_security_enabled` field value is `true`:

       ```bash
       openstack network show <network>
       ```

       If the field value is `false`, [create a new private network](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#create-private-network) or a [public subnet](/cloud-servers/cloud-networks/public-subnets.mdx#create-public-subnet) and [recreate the load balancer in it](/cloud-servers/load-balancers/create-load-balancer.mdx).

    3. Specify allowed IP addresses in the load balancer rule:

       ```bash
       openstack loadbalancer listener set \
       --allowed-cidr <allowed_cidr>
       <listener>
       ```

       Specify:

       * `<allowed_cidr>` — an IP address or subnet in CIDR format. If you need to specify multiple addresses, provide each in a separate `--allowed-cidr`;
       * `<listener>` — the rule ID or name. You can view the list using the `openstack loadbalancer listener list`.
  </TabItem>
</Tabs>

<Formbricks />