IP Restriction Policy

The IP Restriction AI Policy restricts access to your AI Models, AI Agents, and AI MCP Servers by allowing or denying client IP addresses. This can help block malicious activity, such as spam or traffic from unwanted networks. You can use single IPs, multiple IPs, or ranges in Classless Inter-Domain Routing (CIDR) notation like 10.10.10.0/24. The policy supports IPv4 and IPv6 addresses.

Configure the policy with an allow list of IP addresses or ranges to allow and a deny list of IP addresses or ranges to reject. When only an allow list is configured, AI Gateway rejects all IP addresses that aren’t on that list. When only a deny list is configured, AI Gateway accepts all IP addresses that aren’t on the deny list.

Configuring both lists is useful if you want to allow a CIDR range but deny an IP address in that range.

The following example allows 203.0.113.0/24 but denies 203.0.113.5:

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "ip-allow-range-deny-address",
      "display_name": "IP Allow Range and Deny Address",
      "type": "ip-restriction",
      "global": true,
      "config": {
        "allow": [
          "203.0.113.0/24"
        ],
        "deny": [
          "203.0.113.5"
        ]
      }
    }
    '

If you need to limit access to known networks, such as an office VPN or a partner’s address range, use an allow list. If you need to block specific addresses and accept everything else, use a deny list. If you need an exception inside an allowed range, use both lists.

Apply the IP Restriction Policy globally to restrict all AI Gateway traffic on the data plane, or attach it to an AI Agent, an AI MCP Server, an AI Consumer, or an AI Consumer Group to restrict access to that entity only. For details about how scopes work, see AI Policy scopes.

AI Model scope: Do not attach an IP Restriction Policy to an AI Model to block clients.

The AI Policy runs before AI Gateway identifies the Model for the request, so its Model scope never matches and AI Gateway skips the policy without logging anything.

The control plane still accepts the configuration, so the request succeeds and the restriction isn’t applied. As a temporary workaround, apply the policy globally and use a condition to run it only where you need it.

AI Gateway determines the client IP address from a request header set by the client or by a proxy in front of AI Gateway. In most cases, the header is named X-Real-IP or X-Forwarded-For.

By default, AI Gateway uses the X-Real-IP header. If your environment requires a different header, set the real_ip_header Nginx property.

AI Gateway only reads the client IP from the header when the request comes from an address listed in the trusted_ips Nginx property, such as your load balancer. For any other sender, it ignores the header and uses the IP address of the direct connection. If trusted_ips isn’t set, the policy evaluates the IP of the proxy or network gateway in front of AI Gateway, not the original client.

If you configure only an allow list and the load balancer or proxy in front of AI Gateway isn’t listed in trusted_ips, AI Gateway evaluates that address instead of the client’s and can reject all traffic.