Skip to content
HEIMWALL

Trusted IP Exemptions

Security rules can sometimes accidentally block your own team’s tools or partner systems. Correctly exempting trusted IPs maintains both security and operational continuity.

Basic Rules

Section titled “Basic Rules”
# Full allow for the office IP list — bypasses all rules
IF   ip.list in "office-ips"
THEN allow


# Exempt monitoring services from rate limiting
IF   ip.list in "monitoring-services"
THEN bypassratelimit


# Skip CAPTCHA for partner systems
IF   ip.list in "trusted-partners"
THEN bypasscaptcha

With these selections in the console:

  • Allow the office list — Field IP List · Operator in list · Value office-ips → Action Allow
  • Exempt monitoring from rate limits — Field IP List · Operator in list · Value monitoring-services → Action Bypass Rate Limit
  • Bypass CAPTCHA for partners — Field IP List · Operator in list · Value trusted-partners → Action Bypass CAPTCHA

The allow action stops the rule chain entirely and forwards the request to the origin. This approach is appropriate for office IPs because traffic from these sources is already inspected at the network level.

bypassratelimit exempts the request from rate limit counters while letting all other rule layers continue to evaluate. Monitoring services such as Prometheus or Datadog send requests at frequent intervals and can accidentally trigger rate limits without this exemption.

bypasscaptcha skips CAPTCHA validation so that partner systems can operate smoothly in headless environments. Other rules — rate limits, bot score checks, and so on — still apply when this action is used.

Advanced Variant

Section titled “Advanced Variant”
# Exempt requests with an API key from the JS challenge
IF   http.header contains Authorization=Bearer
AND  http.request.base_uri has_prefix /api
THEN bypassjs


# Exempt all requests from the internal network
IF   ip.prefix == 10.0.0.0/8
THEN allow

With these selections in the console:

  • Bypass JS for Bearer token requests — Field Header · Operator contains · Value Authorization=Bearer AND Field Path (without query) · Operator starts with · Value /api → Action Bypass JS
  • Allow the internal network — Field IP Range (CIDR) · Operator equals · Value 10.0.0.0/8 → Action Allow

Exempting API requests that carry an Authorization: Bearer header from the JS challenge lets programmatic clients flow through without interruption while keeping the rest of the security layers active. This rule is especially useful for mobile application backends or inter-microservice communication.

Exempting the RFC 1918 10.0.0.0/8 block with allow lets internal network traffic pass directly through the rule engine. Apply this only after confirming this CIDR block genuinely represents your trusted internal network.

Tips

Section titled “Tips”
  • IP lists are managed under Console → WAF → IP Lists and can be updated without editing any rules
  • When office IPs change, updating the list alone is sufficient — no need to touch the rule line itself
  • Allow stops the rule chain entirely; Bypass CAPTCHA skips only CAPTCHA — other rules continue to run