Configuration

AddIPFilterPolicies() — from configuration

The common path binds the IPFilterConfiguration section from your IConfiguration:

builder.Services.AddIPFilterPolicies(builder.Configuration);

The section name defaults to "IPFilterConfiguration". Pass a different name if you keep the policies elsewhere:

builder.Services.AddIPFilterPolicies(builder.Configuration, configSectionName: "MyIpFilters");

This registers IIPFilterPolicyProvider (implemented by IPFilterPolicyProvider) as a singleton and binds IPFilterPoliciesConfiguration via the options system, so configuration reloads are picked up at runtime.

AddIPFilterPolicies() — from code

To build policies imperatively instead of from configuration, pass a configuration action:

builder.Services.AddIPFilterPolicies(policies =>
{
    policies.Add(new IPFilterPolicy
    {
        PolicyName = "Intranet",
        Mode = IPFilterPolicyMode.AllowList,
        IPNetworks = ["192.168.0.0/24"]
    });
});

See Advanced for the full programmatic setup, including the global policy.

UseIPFilterPolicies() — the middleware

Register the middleware inside MapReverseProxy:

app.MapReverseProxy(proxyPipeline =>
{
    proxyPipeline.UseIPFilterPolicies();
    proxyPipeline.UseLoadBalancing();
});

Important: UseIPFilterPolicies() extends YARP's IReverseProxyApplicationBuilder. Do not add the middleware to the regular ASP.NET Core pipeline (app.UseMiddleware<...>()) — it reads the current route from the YARP reverse-proxy feature, which is only present inside MapReverseProxy. Adding it first means blocked requests are rejected before load balancing, session affinity, or transforms run.

The IPFilterConfiguration section

{
  "IPFilterConfiguration": {
    "EnableGlobalPolicy": true,
    "GlobalPolicyName": "Global",
    "Policies": [
      {
        "PolicyName": "Global",
        "Mode": "BlockList",
        "IPAddresses": ["192.168.0.3", "192.168.0.4"]
      },
      {
        "PolicyName": "Intranet",
        "Mode": "AllowList",
        "IPNetworks": ["192.168.0.0/24"]
      },
      {
        "PolicyName": "TestPolicy",
        "Mode": "Disabled",
        "IPAddresses": ["192.168.0.3", "192.168.0.4"],
        "IPNetworks": ["192.168.0.0/24"]
      }
    ]
  }
}

Top-level keys

When EnableGlobalPolicy is true but no policy matches GlobalPolicyName, the provider throws at startup (and on every reload). Either add the matching policy or set EnableGlobalPolicy to false.

Policy keys

IPAddresses and IPNetworks may be used together in a single policy — a request matches the policy if it matches either list. See Policies for exactly how each mode interprets a match.

Logging

The middleware logs through Microsoft.Extensions.Logging. It uses the high-performance LoggerMessage pattern on the request-handling path, with these events:

Configure levels per category as you would for any ASP.NET Core app:

{
  "Logging": {
    "LogLevel": {
      "BBelius.Yarp.ReverseProxy.IPFilters": "Information"
    }
  }
}