What is a CIDR allowlist?
On this page
A CIDR allowlist is a list of IP address ranges, written in CIDR notation, from which a service accepts certain requests, so that a valid credential used from anywhere else is refused.
How CIDR notation works
Classless Inter-Domain Routing, described in RFC 4632, writes a range as an address, a slash and a prefix length. The prefix length says how many leading bits are fixed:
203.0.113.0/24fixes the first 24 bits, so it covers 256 addresses from203.0.113.0to203.0.113.255;198.51.100.7/32is a single address;- IPv6 uses the same idea, for example
2001:db8::/32.
The addresses above come from ranges reserved for documentation by RFC 5737 for IPv4 and RFC 3849 for IPv6, so they never point at a real network.
Why teams use allowlists
A stolen token or password is usually used from somewhere unexpected. If production secrets are served only to the office network and the production machines' range, a leaked credential used from a hotel network or a cloud VM gets a refusal instead of data. An allowlist is a second condition on top of the credential.
How Crunu does it
In Crunu, you can Restrict by network… any environment, so its contents are served only to allowed addresses, IPv4 or IPv6:
- Network lists are named, signed sets of ranges, for example Kiteline's office
203.0.113.0/24and its machines198.51.100.0/24. Kiteline is a fictional company. - Tightening takes effect immediately. Relaxing a rule takes effect after 15 minutes, with an alert and a Cancel relaxation button, or at once with a second admin's signature.
- Machine passes let a machine keep receiving content for a while (24 hours by default) after its address changes, so a cloud host that gets a new IP does not go dark.
- Break-glass access lets an owner bypass the rule for up to 60 minutes, with a reason and an alert.
- A restricted environment can also block share links entirely, or accept only CI tokens with an OIDC binding.
- Restricted environments are left out of offline copies.
When the agent is refused for network reasons, it exits with code 7 for that environment.
See network rules, restrict production to the office network and network rules.
Sources
- RFC 4632: Classless Inter-domain Routing (CIDR), checked October 27, 2026.
- RFC 5737: IPv4 Address Blocks Reserved for Documentation, checked October 27, 2026.
- RFC 3849: IPv6 Address Prefix Reserved for Documentation, checked October 27, 2026.
From the blog
Security
Audit logs you can verify: how hash chains work
An audit log is only evidence if nobody can quietly edit it. How hash chains make tampering visible, what they miss, and how to check an export yourself.
Security
One key per environment: why dev must not open prod
Most tools separate dev and prod with permissions the server enforces. Why the boundary is stronger when each environment has its own encryption key.
Self-hosting
Self-hosting a secrets vault: choosing a platform
Docker on a VPS, Cloudflare Workers, Vercel or Cloud Run? What changes between platforms for a blind-server vault, and the two decisions you make only once.