How to retrieve Azion IP ranges for origin server allowlisting

Learn how to retrieve Azion's IP/CIDR ranges via Origin Shield to configure allowlists on your origin server.

View as Markdown

When your application’s origin server sits behind Azion, all inbound requests arrive from Azion’s global infrastructure — not directly from end users. To secure your origin, you need to allowlist only Azion’s IP/CIDR ranges and block everything else.

Origin Shield provides the Azion Origin Shield network list — a curated, dynamically updated list of all IPv4 and IPv6 prefixes used exclusively by Azion’s global infrastructure to connect to origin servers.

Prerequisites

Access the list via Azion Console

  1. Access Azion Console > Network Lists.
  2. Select Azion Origin Shield from the list.
  3. In the List field, copy all IP/CIDR entries.

Access the list via API

Run the following request, replacing [TOKEN VALUE] with your personal token:

curl --request GET \
--url https://api.azion.com/v4/workspace/network_lists \
--header 'Accept: application/json' \
--header 'Authorization: Token [TOKEN VALUE]'

The response will include the Azion Origin Shield entry:

{
"count": 4,
"total_pages": 1,
"schema_version": 3,
"links": {
"previous": null,
"next": null
},
"results": [
{
"id": 2345,
"last_editor": "last.editor@azion.com",
"last_modified": "2023-03-27T21:19:27.996870Z",
"list_type": "ip_cidr",
"name": "Azion Origin Shield",
"country_list": [],
"ip_list": [
"192.0.2.0/24",
"2001:db8::/32"
]
}
]
}

The ip_list field contains all current Azion prefixes. Use these values to configure your origin firewall.

Azion sends an email notification every time the list is updated. You have 7 days to apply the new addresses to your origin firewall rules or automations before new servers go into production.

Secure an infrastructure Origin Shield reference Network Shield reference Network Lists reference