Configure access security
Combine network rules, trusted proxies and security alerts with account authentication, while preserving a tested administrator access path.
Identify the actual network path
Open Administration → Access security. First establish whether browsers reach Obelisk directly or through a reverse proxy. An office connection, a VPN and a proxy can present different source addresses. Base restrictions on the verified path used by staff, including the administrator.
Set rules and alerts
Choose disabled filtering, a blocklist or an allowlist according to the intended policy. Enter individual IPv4/IPv6 addresses or CIDR networks in the network list. Review the complete list before saving an allowlist that could exclude your current connection.
Declare trusted proxies
Add only the actual reverse proxies. Forwarded client information is trusted only through a configured trusted peer; the proxy must overwrite the relevant forwarded headers.
Set alert recipients
Enable the required security alerts and enter their recipients. These recipients are separate from scheduled report recipients, although both depend on a working SMTP configuration.
Combine network policy with account protection
Network rules determine which connections may reach authentication. Account permissions and 2FA answer different questions: what an authenticated person may do and how that person proves their identity. Configure all three according to the actual team and access path.
Choose the filtering mode
With filtering off, no IP list restriction is applied by this policy. A blocklist rejects listed addresses; an allowlist limits access to listed addresses or networks. Enter one valid IPv4, IPv6 or CIDR entry per line and review the complete set.
Declare only real trusted proxies
Add a reverse proxy only when it is the verified immediate peer and safely sets forwarded client-address headers. Obelisk uses forwarded addresses only through configured trusted proxies. Check the resulting client address in Access log.
Set alert recipients and test access
Enable the intended security alerts and set their own recipients. Check SMTP in System and utilities, then verify a permitted login from the team’s actual network. AI report recipients are configured separately.
Test an allowed connection
From a verified permitted network, open a fresh session and check the Access log. If using a proxy, confirm the recorded source address matches the intended interpretation. Verify SMTP delivery separately: saving recipient settings does not demonstrate that an email reached its destination.
Recover without broadening access blindly
If an authorized person is blocked, investigate the effective source address and matching rule before weakening the policy. Network filtering does not replace passwords, 2FA or page permissions. Destination-specific IP and proxy rules are preserved by configuration restore; verify them on the destination server.
Use the controls, understand what changes
Choose disabled filtering, blocklist or allowlist before entering addresses. A trusted-proxy entry describes the actual immediate proxy, not any address claimed by a browser. After saving, verify the client address in Access log using an allowed connection.
Complete product screenshots
Illustrative data. Open the screenshot to enlarge it and match the controls to the instructions in this chapter.
Open complete screenshot