> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/security-and-governance/firewalls-and-acls.md).

# Firewalls and ACLs

Learn about Firewall and ACLs in Couchdrop

## Overview

Network Access Control Lists (ACLs) restrict access to Couchdrop based on the IP address or network that a connection originates from.

ACLs can be configured at three levels:

* **User-based ACLs** — restrict access for an individual user.
* **Group-based ACLs** — restrict access for members of a group.
* **Tenant-based ACLs** — restrict access across the Couchdrop tenant using the **Firewall** settings.

## Tenant-level ACLs

To configure network restrictions for the entire tenant, navigate to the **Firewall** section.

Under **Configure Allowed IPs**, add the IP addresses or network ranges that should be permitted to access Couchdrop.

The **Network ACLs - Allow these IPs globally** setting applies the configured allowlist across the tenant.

Click **Save updates** after making changes.

{% hint style="warning" %}
Before enabling tenant-wide restrictions, make sure the IP addresses and network ranges required by your users, partners, and connected systems are included.
{% endhint %}

## User and group ACLs

ACLs can also be configured for individual users and groups.

User-level ACLs let you restrict a specific user so they can only connect from approved IP addresses or networks. 

Group-level ACLs apply network restrictions to users through their [group membership](/administration/user-and-group-management/groups.md).

## How ACLs are evaluated

ACLs are additive across the user, group, and tenant levels.

Where multiple ACLs apply, Couchdrop evaluates the configured allowed IP addresses and network ranges when the user authenticates.