---
title: "Black Fedora (@blackfedora) | Hashnode"
description: "Black Fedora. Read the latest articles by Black Fedora on Hashnode."
url: "https://hashnode.com/@blackfedora"
---

@blackfedora

# Black Fedora

@blackfedora · Joined April 2022

Black Fedora

## Comments

[JV didn't get the notification about the reply! I think you're on the right track! Using tcp-request content deny along with tcp-request inspect-delay 5s in HAProxy for TCP mode is a good approach. The inspect delay gives HAProxy time to gather enough data to enforce your rule effectively. I would fine-tune the delay time as needed for the best balance between security and performance. Great job figuring this out!](https://hashnode.com/posts/haproxy-restrict-access-by-ip-address/6247da6d4b4dde0dc0be606b/comment/654a40c191ec4bf2c5dea945#reply-65a3802af427a71379ed089b)

Reply · Article · Jan 14, 2024 · [HAProxy: Restrict access by IP address](https://hashnode.com/posts/haproxy-restrict-access-by-ip-address/6247da6d4b4dde0dc0be606b)

[If you need to block CIDR ranges based on the X-Forwarded-For header in HAProxy, you can accomplish this by setting up ACLs in your HAProxy configuration. Here's a quick guide: Create ACLs for the CIDR ranges you want to block. Place these in the frontend section of your haproxy.cfg. Extract the actual client IP from the X-Forwarded-For header using the hdr() function. Implement blocking by using the http-request deny directive if the IP extracted matches any on your blacklist. Here’s an example snippet: frontend http-in bind \*:80 # ACL for blacklisted CIDR ranges acl ip\_blacklisted src -f /etc/haproxy/blacklist.lst # Check for X-Forwarded-For header acl xff\_ip hdr(x-forwarded-for) -m found # Match the IP against the blacklist acl xff\_ip\_in\_blacklist hdr\_ip(x-forwarded-for,1) -f /etc/haproxy/blacklist.lst # Deny requests from blacklisted IPs http-request deny if xff\_ip xff\_ip\_in\_blacklist default\_backend servers Make sure your blacklist.lst contains the proper CIDR blocks you're aiming to restrict. After updating your configuration, don’t forget to reload HAProxy to apply the changes. This is usually done with sudo systemctl reload haproxy or a similar command depending on your system. Hope this helps!](https://hashnode.com/posts/haproxy-restrict-access-by-ip-address/6247da6d4b4dde0dc0be606b/comment/654a40c191ec4bf2c5dea945#reply-654a427191ec4bf2c5dea976)

Reply · Article · Nov 7, 2023 · [HAProxy: Restrict access by IP address](https://hashnode.com/posts/haproxy-restrict-access-by-ip-address/6247da6d4b4dde0dc0be606b)