---
title: "Discussion on \"HAProxy: Restrict access by IP address\" | Hashnode"
description: "Discussion on \"HAProxy: Restrict access by IP address\". Crude way to stop an attack in case of an emergency."
url: "https://hashnode.com/posts/haproxy-restrict-access-by-ip-address/6247da6d4b4dde0dc0be606b"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [HAProxy: Restrict access by IP address](https://blackfedora.dev/haproxy-restrict-access-by-ip-address?utm_source=hashnode&utm_medium=feed)

Crude way to stop an attack in case of an emergency.

Apr 2, 2022 · 2 min read · blackfedora.dev  
Updated Apr 8, 2022  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#proxy](https://hashnode.com/tag/proxy)

## Written by

[Black Fedora](https://hashnode.com/@blackfedora)

@blackfedora

  
[View profile](https://hashnode.com/@blackfedora)

Black Fedora

## Responses 1

Markdown supported · ⌘↵ to post

[JV](https://hashnode.com/@jv80)

[Nov 7, 2023](https://hashnode.com/posts/haproxy-restrict-access-by-ip-address/6247da6d4b4dde0dc0be606b/comment/654a40c191ec4bf2c5dea945)

Nice! How do you do this to block CIDR ranges from a different header? E.g get the IP from the X-Forwarded-For header and compare against a blacklist?

[JV](https://hashnode.com/@jv80)

[Nov 9, 2023](https://hashnode.com/posts/haproxy-restrict-access-by-ip-address/6247da6d4b4dde0dc0be606b/comment/654a40c191ec4bf2c5dea945#reply-654c249b4a0606fcdd91f028)

Oh wow! Thanks [Black Fedora](https://hashnode.com/@blackfedora) for this config guide. I have spent all day playing around with it.

I'm in `tcp mode` so I used `tcp-request content deny` instead of `http-request deny`and found out I needed to add `tcp-request inspect-delay 5s` to make it work. Does that sounds about right?

[Black Fedora](https://hashnode.com/@blackfedora)

[Jan 14, 2024](https://hashnode.com/posts/haproxy-restrict-access-by-ip-address/6247da6d4b4dde0dc0be606b/comment/654a40c191ec4bf2c5dea945#reply-65a3802af427a71379ed089b)

[JV](https://hashnode.com/@jv80) didn't get the notification about the reply!

I think you're on the right track! Using `tcp-request content deny` along with `tcp-request inspect-delay 5s` in HAProxy for TCP mode is a good approach. The inspect delay gives HAProxy time to gather enough data to enforce your rule effectively. I would fine-tune the delay time as needed for the best balance between security and performance. Great job figuring this out!

[JV](https://hashnode.com/@jv80)

[Jan 25, 2024](https://hashnode.com/posts/haproxy-restrict-access-by-ip-address/6247da6d4b4dde0dc0be606b/comment/654a40c191ec4bf2c5dea945#reply-65b2c6b9bfba218f79871ffc)

[Black Fedora](https://hashnode.com/@blackfedora) No worries! This config seems to be working well for me. I lowered the inspect-delay to 3s. Thanks for your help and advice.