Skip to content

Blacklist IP Address

Overview

The Yappes Blacklist IP Address feature allows you to create subscription-level gateway policies that block specific IP addresses from accessing your APIs, so you can enhance security and control access to your services.

This powerful security feature enables organizations to proactively prevent unwanted or potentially malicious traffic from reaching their APIs by maintaining a blacklist of IP addresses that should be denied access.

As a subscription-level gateway policy, the Blacklist IP Address feature provides granular control over API access management. You can create multiple blacklist policies with different sets of restricted IP addresses and selectively apply them to specific API subscriptions, based on your security requirements.

This flexibility ensures that you can implement targeted security measures without affecting legitimate users or disrupting overall API operations. The feature integrates seamlessly into the Yappes platform's gateway policy framework, making it easy to manage alongside other API governance policies. By implementing IP blacklisting at the subscription level, you can protect sensitive APIs from known threats, comply with security requirements, and maintain complete control over who can access your services.

Prerequisites

Before implementing the Blacklist IP Address feature, ensure you have:

  • Administrative access to the Yappes API Manager platform
  • Permission to create and manage Gateway Policies
  • Access to the Manage Subscriptions section
  • At least one active API subscription to attach the policy to
  • List of IP addresses to be blacklisted (format: xxx.xxx.xxx.xxx)

Custom error and message

For error scenarios, you can override the default HTTP status code, error code, and message. See Custom Error and Message.

Step-by-Step Implementation

Step 1: Navigate to Gateway Policies

  • Locate Gateway Control → Gateway Policies in the main navigation menu
  • The policies management interface will display

navigate to Gateway Policies

Step 2: Create a New Blacklist IP Address Policy

  • Click Create policy from the gateway page
  • Set the Control Level to Subscription Level
  • In the Policy Type dropdown, select Blacklist IP Address

Create a New Blacklist IP Address Policy

Step 3: Set the Policy Name

  • Enter a descriptive name in the Policy Name* field (e.g., Blacklist_ip_1)
  • Add a detailed description in the text area field to document the policy purpose

Set the Policy Name

Step 4: Add IP Addresses

  • In the Enter IP Address field, input the IP addresses to be blacklisted
  • Format: Enter IP addresses separated by commas
  • Example: 172.1.2.3, 189.23.33.1
  • Ensure no extra spaces or invalid characters

Add IP Addresses

Step 5: Save the Policy

  • Review all entered information for accuracy
  • Click the Create Policy button to create the policy
  • You should see a confirmation message, and the new policy will appear in the Gateway Policies list

Save the Policy

Step 6: Navigate to Manage Subscriptions

  • From the main menu, click on Manage Subscriptions
  • The Manage Subscriptions page will display a list of all API subscriptions
  • Locate the subscription(s) where you want to apply the blacklist policy

Navigate to Manage Subscriptions

Step 7: Attach the Policy to Subscriptions

  • Click the Attach or Detach button for the relevant subscription
  • The policy attachment dialog will open

Attach the Policy to Subscriptions

Step 8: Select and Attach the Policy

  • In the Select Policy to Attach dropdown field, choose your newly created blacklist policy (e.g., Blacklist_ip_1)
  • Choose the attachment level:
    • API Level: Applies Blacklist IP to all endpoints of an API
    • Endpoint Level: Applies Blacklist IP to specific endpoints only
  • Click Attach to apply the policy to the subscription

Select and Attach the Policy

Step 9: Verify Policy Attachment

  • Confirm that the policy appears in the attached policies list for the subscription
  • Test access from both blacklisted and non-blacklisted IPs to verify proper functioning

Verify Policy Attachment

Understanding the Interface

Key Form Fields

  • Control Level*: Required field that must be set to "Subscription Level" for blacklist policies
  • Policy Name*: Required unique identifier for your policy
  • Policy Type*: Determines the functionality – select "Blacklist IP Address"
  • Description: Optional field for documenting the policy purpose
  • Enter IP Address*: Comma-separated list of IP addresses to block

Subscription Management Interface

The Manage Subscriptions section provides:

  • List of all active API subscriptions
  • Consumer/organization information
  • API names and subscriptions
  • Attach/Detach functionality for policy management

Configuration and Settings

Required Configuration Fields

  • Control Level: Must be set to "Subscription Level"
  • Policy Name: Unique identifier (no special characters recommended)
  • IP Addresses: Valid IPv4 addresses in format xxx.xxx.xxx.xxx

Best Practices for IP Address Entry

  • Use comma separation between multiple IP addresses
  • Avoid extra spaces: 172.1.2.3,189.23.33.1
  • Verify IP addresses are in valid format before saving
  • Document the reason for blacklisting in the description field

Policy Attachment Options

  • API Level: Applies the blacklist to all endpoints within the API
  • Consumer-Specific: Target specific consumers or organizations
  • Multiple policies can be attached to a single subscription if needed

Verification and Testing

Confirming Successful Policy Creation

  • Navigate back to Gateway Policies after creation
  • Verify your policy appears in the list with:
  • Correct policy name
  • Subscription Level as control level
  • Blacklist IP Address as policy type

Testing the Blacklist

  • Attempt to access the API from a blacklisted IP address
  • The request should be denied with an appropriate error message
  • Verify that non-blacklisted IP addresses can still access the API normally

Monitoring Policy Effectiveness

  • Check API access logs for blocked requests
  • Monitor for any false positives (legitimate users being blocked)
  • Review and update the blacklist regularly based on security requirements

Troubleshooting

Common Issues and Solutions

  • Issue: Policy not appearing in the attachment dropdown
    Solution: Ensure the policy was saved successfully and set to Subscription Level

  • Issue: IP addresses still able to access API after blacklisting
    Solution: Verify the policy is attached to the correct subscription and API level

  • Issue: Invalid IP address format error
    Solution: Check for typos, extra spaces, or invalid characters in the IP address field

  • Issue: Unable to save policy
    Solution: Ensure all required fields are filled and IP addresses are properly formatted

Error Messages

  • "Invalid IP format": Check that all IP addresses follow xxx.xxx.xxx.xxx format
  • "Policy name already exists": Choose a unique name for your policy
  • "Subscription level required": Ensure Control Level is set to Subscription Level

When to Contact Support

Contact Yappes Support if you encounter:

  • Policies not being enforced despite correct configuration
  • System errors when creating or attaching policies
  • Performance issues after implementing multiple blacklist policies

Pro Tip

Regularly review and update the blacklist to ensure it's targeting only malicious or unwanted IPs. Automating updates from threat intelligence feeds can improve security without blocking legitimate users.