IP Whitelisting

IP allowlisting authenticates a connection by its public source address. Add an address and connections from it are accepted with no credentials at all.

Set up an allowed source

1. Find the address you will connect from

   Run this on the machine that will open the proxy connections:

   curl https://httpbin.org/ip

2. Add it to the subscription

   Open the subscription in the dashboard and use its IP allowlist controls. Adding your first address switches the subscription to accept both allowlisted sources and your password, and publishes a second set of endpoints; removing the last one switches it back to password only.

3. Use the allowlist endpoints

   The endpoints table marks each row with its authentication mode. Use the rows marked for the allowlist.

Connecting

No credentials are needed:

curl -x http://YOUR_HOST:YOUR_HTTP_PORT \
  https://httpbin.org/ip

Targeting without a password

Targeting normally travels on the credential, and an allowlisted connection does not send one. To target an exit from an allowlisted source, send the parameters as the username and leave the password empty:

curl -x http://YOUR_HOST:YOUR_HTTP_PORT \
  -U "country-de-session-ab12cd:" \
  https://httpbin.org/ip

Every option from How to Connect works here. The username is read as targeting and nothing else — it is not a login, so any value in front of the parameters is ignored, and the parameters can stand alone as above.

The same works for SOCKS5 clients that offer a username but no password:

curl --socks5-hostname YOUR_HOST:YOUR_SOCKS_PORT \
  --proxy-user "country-de:" \
  https://httpbin.org/ip

Note

Sending your real password alongside a username switches back to normal credential authentication, from any address. The allowlist only answers the case where no password was sent.

Choosing between the two

Allowlisting removes your proxy credentials from the network you connect from — worth having on the plain http and socks5 ports, where a username would otherwise travel in clear text. It requires a stable address.

Password authentication works from anywhere, which is what you want from a laptop, a dynamic connection, or anywhere you cannot pin an address.

Both are available at once once an address is added, so you can use whichever suits each machine.

Caution

Allowlisting trusts every process that can reach the internet through that address, including anything else on the same network. Use a stable, controlled source, and remove addresses you no longer use.