Route Configuration

Route-specific filtering is opt-in per YARP route. A route participates by carrying an IPFilterPolicy entry in its Metadata whose value is the name of a policy you defined in IPFilterConfiguration.

Attaching a policy

Add the IPFilterPolicy key to the route's Metadata:

{
  "ReverseProxy": {
    "Routes": [
      {
        "RouteId": "admin",
        "ClusterId": "admin-cluster",
        "Match": { "Path": "/admin/{**catch-all}" },
        "Metadata": { "IPFilterPolicy": "Intranet" }
      },
      {
        "RouteId": "public",
        "ClusterId": "public-cluster",
        "Match": { "Path": "/{**catch-all}" }
      }
    ]
  }
}

Here the admin route is filtered by the Intranet policy, while public has no IPFilterPolicy metadata and is never filtered by a route-specific policy (the global policy, if enabled, still applies to both).

How a route is resolved

For each request the middleware reads the current route from YARP's reverse-proxy feature and inspects its metadata:

1. No IPFilterPolicy key, or an empty value → the middleware logs a Debug event (NoIPPolicyFound) and

passes the request through untouched.

1. A policy name that resolves → the IP is matched against that policy in its configured mode. Allowed requests

continue; blocked requests receive 403 Forbidden.

1. A policy name that does not exist → this is treated as a configuration error. The middleware logs a

Critical event (PolicyIsNull), sets the response to 500 Internal Server Error, and throws IPFilterPolicyNotFoundException. Keep route metadata and your policy list in sync so this never fires in production.

1. A policy in Disabled mode → logs an Information event (PolicyIsDisabled) and passes through.

Evaluation order

When a global policy is enabled, it is checked first, for every request. Only if the request survives the global policy does the route-specific policy run. A request must pass both to reach the backend. See Global Policy for details.

Notes

• The metadata key is case-sensitive and must be exactly IPFilterPolicy.
• One route references at most one policy. To combine rules, put both IPAddresses and IPNetworks in a single

policy (see Combining addresses and networks).

• Route metadata is part of your YARP config and reloads with it — changing which policy a route uses does not need

a restart.