---
title: Allow traffic from IP addresses in allowlist only · Cloudflare Web Application Firewall (WAF) docs
description: This example skips WAF rules for requests from IP addresses in an allowlist (defined using an IP list).
lastUpdated: 2024-09-09T08:36:56.000Z
source_url:
  html: https://a74404c8.preview.developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-ips-in-allowlist/index.md
  md: https://a74404c8.preview.developers.cloudflare.com/waf/custom-rules/use-cases/allow-traffic-from-ips-in-allowlist/
---

This example skips WAF rules for requests from IP addresses in an allowlist (defined using an [IP list](https://developers.cloudflare.com/waf/tools/lists/custom-lists/#lists-with-ip-addresses-ip-lists)).

1. [Create an IP list](https://developers.cloudflare.com/waf/tools/lists/create-dashboard/) with the IP addresses for which you want to allow access.\
   For example, create an IP list named `allowed_ips` with one or more IP addresses. For more information on the accepted IP address formats, refer to [IP lists](https://developers.cloudflare.com/waf/tools/lists/custom-lists/#lists-with-ip-addresses-ip-lists).

2. Create a custom rule skipping all rules for any request from the IPs in the list you created (`allowed_ips` in the current example).

   * **Expression**: `(ip.src in $allowed_ips)`

   * **Action**: *Skip:*

     * *All remaining custom rules*

     * *Skip phases*:

       * *All rate limiting rules*
       * *All Super Bot Fight Mode rules*
       * *All managed rules*

Make sure the new rule appears before any other custom rules in the rules list.

## Other resources

* [Use case: Require known IP addresses in site admin area](https://developers.cloudflare.com/waf/custom-rules/use-cases/site-admin-only-known-ips/)
* [Available skip options](https://developers.cloudflare.com/waf/custom-rules/skip/options/)
