<!-- review: finished -->

<a id="stream-access"></a>

# Access

The module allows limiting access to certain client addresses.

<a id="configuration-example-56"></a>

## Configuration Example

```nginx
server {
    ...
    deny  192.168.1.1;
    allow 192.168.1.0/24;
    allow 10.1.1.0/16;
    allow 2001:0db8::/32;
    deny  all;
}
```

The rules are checked in sequence until the first match is found. In this example, access is allowed only for IPv4 networks `10.1.1.0/16` and `192.168.1.0/24` excluding the address `192.168.1.1`, and for IPv6 network `2001:0db8::/32`.

<a id="directives-65"></a>

## Directives

<a id="index-0"></a>

<a id="s-allow"></a>

### allow

| [Syntax](https://en.angie.software//angie/docs/configuration/configfile.md#configfile)   | `allow` address | CIDR | `unix:` | `all`;   |
|------------------------------------------------------------------------------------------|---------------------------------------------|
| Default                                                                                  | —                                           |
| [Context](https://en.angie.software//angie/docs/configuration/configfile.md#configfile)  | stream, server                              |

Allows access for the specified network or address. If the special value `unix:` is specified, allows access for all UNIX domain sockets.

<a id="index-1"></a>

<a id="s-deny"></a>

### deny

| [Syntax](https://en.angie.software//angie/docs/configuration/configfile.md#configfile)   | `deny` address | CIDR | `unix:` | `all`;   |
|------------------------------------------------------------------------------------------|--------------------------------------------|
| Default                                                                                  | —                                          |
| [Context](https://en.angie.software//angie/docs/configuration/configfile.md#configfile)  | stream, server                             |

Denies access for the specified network or address. If the special value `unix:` is specified, denies access for all UNIX domain sockets.