Firewall

With the firewall you decide from where people in your company may sign in and work – e.g. only from the office and via your VPN. You can also see failed sign-ins and unlock accounts that were locked after too many wrong passwords.

#Before you start

You need the "Manage firewall (sign-in only from approved IP ranges, block list, locked accounts)" permission. It is intended only for Owner and Administration. The firewall cannot be changed during allverto support access – the company manages it itself.

At the top of the page a status line shows the current Company rules and Your IP (with country, if known). The page has four tabs: Overview, Log, IP lists and Settings.

#How the company rules work

The check happens not only when signing in but on every request – even if the IP address changes during the session. The rules also apply to signing in on POS devices and to API keys. Signing out is always possible; allverto support access is exempt.

Under Settings → Company rules you choose whether the rules apply:

#Step by step: sign-in only from the office

1. Open gear → Firewall and switch to the Settings tab.
2. If your current IP address is not yet allowed, a yellow notice appears. Click Allow my IP – the New rule popup is prefilled with your IP, the type Allow and the reason "Office". Save with Allow.
3. In the IP lists tab, use New rule to add further allowed entries, e.g. your VPN's network or a second branch.
4. Under Company rules, first set Log only (test) and click Save settings.
5. Watch the Log tab for a few days: if "Logged only" shows up there for colleagues (e.g. working from home), an allowed entry is still missing.
6. Then set Active – enforce rules and save. allverto asks for confirmation to be safe – confirm with Activate.

#Creating or changing a rule

In the IP lists tab, click New rule; open an existing rule by double-clicking or right-click → Edit. In the popup:

• IP address or network – a single address (e.g. 203.0.113.7) or a network in CIDR notation (e.g. 203.0.113.0/24), IPv4 or IPv6. If you write it differently, allverto shows "Will be saved as …".
• Type – Block – deny access or Allow – never block / allow sign-in.
• Reason – free text, e.g. "Berlin office" or "Attacks on sign-in".
• Valid – Indefinite, 1 hour, 24 hours, 7 days, 30 days or Until date… (then choose Up to and including).

For each rule the list shows Type, IP address / network (with "(your IP)" if your address is in it), Reason, Source (Manual for your rules), Expires, Hits and Last hit. Expired rules are greyed out. Right-click also offers Show in log and Delete.

#Overview

In the Overview tab you choose the period (Last 24 hours to Last 90 days) and see:

• tiles for Blocked, Logged only, Failed sign-ins, Account locks, Active IP bans and Own rules,
• Events per day as a chart,
• Top IPs – right-click for Show in log, Block IP…, Allow IP… or Copy IP. Your own IP is marked with "(you)" and can't be blocked.
• By module – where the events come from,
• Locked accounts with lock time and number of failed attempts.

#Unlocking locked accounts

After several wrong passwords, allverto temporarily locks the account. This protection is always active, even if the company rules are off.

1. Open the Overview tab and scroll to Locked accounts.
2. Click Unlock for the account and confirm.

The person can sign in again immediately and the failed attempts are reset. Alternatively, you can do this in the Log by right-clicking an "Account locked" entry → Unlock account.

Under Settings → Protection against failed attempts, the Also inform the owner by email when an account is locked switch controls whether the owner gets a message (default: on). The affected person is also informed by email.

#Log

The Log tab lists all events with Time, Action, Module, Rule, IP address, Country, Account, Request and Detail (can be shown: User agent). You can filter by Search (path, account, detail), IP (address or network), Period, Module and Action. 200 entries are loaded at first, more via Load older.

Right-click a row: Show in log, Block IP…, Allow IP…, Unlock account (for locked accounts) and Only this module.

#Frequently asked questions

#A colleague can't get in from home any more.

Their IP address isn't on the allow list. Search the Log for their account, right-click the row and choose Allow IP… – preferably with a time limit if the address at home changes often. A better permanent solution: access via an allowed VPN.

#Why aren't the allowed countries being checked?

The country comes from the upstream network. If no country is known for your request, the Settings tab shows a notice – in that case no blocking by country takes place.