Security Guide · For Owners & Managers
You don't have to be technical to make one of the highest-value security decisions available to you. Restricting your sensitive systems to an approved network address removes them from the open internet — so most attacks never reach you in the first place.
Most security conversations jump straight to "is our login strong enough?" That matters — but it assumes the whole internet already gets to try. A better first question for an owner or manager is simpler, and it changes everything.
If a system faces the open internet, every scanner, bot and automated attacker on earth can knock on its door — continuously, day and night.
Sign-in and multi-factor prove identity — but only for people who already reached the door. They can't reduce how many people get to try.
If something ever does slip through, the real question is how far it can travel. Managing risk means limiting reach and consequence, not just entry.
Don't make your systems easier to find than they need to be.
Every device on the internet has an address — an IP. Allowlisting means your system agrees to accept connections from only the addresses you approve. Everyone else is turned away at the network, before they ever reach your application.
Everyone outside that approved path is stopped at the door.
An allowed IP is a gate, not a badge. It answers should this connection reach us — never who is this. Keep strong sign-in and least-privilege access working behind it. And prefer a dedicated IP that's yours alone: a "static" address shared across many VPN customers is weaker than it first looks.
Attackers increasingly route traffic through ordinary home internet connections, so "this address looks normal" is no longer a reliable signal — a point reinforced by recent ASD guidance. Exact allowlisting sidesteps this entirely: it never asks whether an address looks trustworthy, only whether it is the specific one you approved. As telling good traffic from bad gets harder, reducing who can reach you becomes more valuable, not less.
The technical detail — IP reputation vs exact allowlisting →Allowlisting isn't for everything. It shines on systems the wider public never needs to reach. The test is simple: does the outside world actually need to get to this? If not, it doesn't need to be reachable.
Gating your internal and administrative systems typically covers most of the risk with none of the disruption — customers never touch those systems, so they never notice the change.
Not every option costs the same or protects the same. Here's roughly how the choices stack up — and where most teams land for a sensible balance of effort and protection.
| Approach | Who can reach it | Attacker effort | Practical fit |
|---|---|---|---|
| Open to the internet | Everyone, everywhere | Lowest | Public services only |
| Shared VPN fixed IP | You — and others on that IP | Low | Weaker than it looks |
| Dedicated VPN with fixed IP | Only your organisation (via VPN) | Higher | Sweet spot for most |
| Dedicated cloud IP (Elastic IP) | Only your organisation | Higher | Strong, no VPN dependency |
| Private network / zero-trust | No normal public reach | High | Strong, more setup |
| Private + verified device | No public reach, checked device | Highest | Strongest model |
A dedicated VPN with a fixed IP is the practical starting point for most teams — much smaller exposure, without a major rebuild. A dedicated cloud IP does the same job with one fewer moving part. Either way, read the next section first: the VPN is a risk of its own.
Whitelisting via a VPN doesn't remove risk; it moves it. You take away a large, well-understood risk and take on a smaller, different one. Worth doing — but only with eyes open, because the new risk shows up in a place people forget: keeping your own access working.
This is the big one. For most organisations it is the dominant day-to-day threat — and it is exactly what a fixed-IP gate removes.
The VPN account, provider and infrastructure now sit in front of your systems — so each becomes something that could be compromised. Real, but much smaller than internet-wide exposure. This is why the IP is a gate, never proof of identity.
This is the one people miss. If the VPN drops, the IP changes, or the account lapses, legitimate users — including your own administrators — can be locked out of their own systems. That's a continuity risk, not a security one, and it points the opposite way: with no gate at all, a VPN outage could never lock you out.
The security case is strong, so the honest job isn't to avoid the VPN — it's to make sure the VPN can never become the reason no one can get in. Four low-cost habits do most of the work.
A documented, tightly-controlled path back that doesn't depend on the VPN — used only in an emergency, and audited every time it is.
A second dedicated IP or egress route, so one VPN outage can't cut off every administrator at the same moment.
So restoring access isn't improvised under pressure. Everyone who needs in knows exactly how, before they need to.
Watch the VPN and the fixed IP. If either changes or fails, you hear about it before your users and admins do.
So is it worth it? On balance, yes — a dedicated VPN with IP whitelisting removes far more risk than it adds, because internet-wide exposure is the bigger threat by a wide margin. But that judgement only holds if you treat access continuity as a first-class concern. Whitelisting without a break-glass plan can quietly trade a security gain for a continuity loss — and that trade is avoidable.
Think of security as a series of independent checks. Allowlisting handles the first and does the heavy lifting on volume — the layers behind it make sure a rare, determined attacker still can't get far.
IP allowlisting removes most of the pressure at the door; the layers behind it make sure the rare attacker who gets past one control still can't get far. That combination is what actually manages the risk.
You don't need to boil the ocean. A short, ordered set of steps gets most of the value — and each one is a decision an owner or manager can direct without writing a line of code.
Write down which systems only staff, partners or operations ever touch. Those are your candidates for gating.
A dedicated-IP VPN or a cloud workstation with a fixed address gives you one known front door to approve.
Restrict those internal systems to your approved IP. Everyone else is turned away before they reach the application.
The IP is the gate. Behind it, keep multi-factor or passkeys and short sessions — never rely on the address alone.
Give people and systems only the access they need. A smaller blast radius means a smaller problem if anything goes wrong.
IPs and teams change. Revisit the allowlist so it keeps matching exactly who actually needs to get in.
The technical companion to this page — for whoever will actually configure the allowlist, and for understanding why this control is getting more valuable, not less.
Why residential proxies and autonomous AI erode reputation, geo and ASN controls — and why exact /32 allowlisting keeps its value. Includes the reference architectures for restricted and public services.
Most attacks depend on reaching you. Take internal systems off the open internet and most of that pressure disappears.
A permitted IP decides who may connect — not who they are. Keep identity and permissions doing their own job behind it.
Assume something could still slip through one day, and make sure it can reach very little when it does.
The goal isn't a perfect wall. It's to force any attacker down a much smaller, more specific path before they can even interact with your systems — and to keep the damage tiny if they ever do.