Allowlisting checklist for any tool

Most IP allowlists go wrong the same three ways: the IP was added before the app was routed, an admin locked themselves out, or a second region was added months later and nobody updated the list. This is the order that avoids all three, whatever the tool.

1. Find your gateway IP(s)

Dashboard → Organisation → Gateway. One IP per region you've assigned. If you use Assigned gateways to pin the team to a single region, you'll only have one.

2. Route the app through Reach first

Add the tool's domains to your organisation's routing policy (see Group policy) and confirm on one member's device:

  1. Switch Reach on, open the tool, check the tool's own "your IP" or session page (or https://reach.tyo.com.au/whoami-style checkers such as the IP shown in your dashboard).
  2. It should show the gateway IP, not the member's home address.

3. Add the IP as a /32

Enter 203.0.113.10/32 (or start = end in tools that use ranges). Never widen it to a /24 "to be safe" — that admits 255 strangers.

4. Test before you enforce

Wherever the tool separates adding addresses from enabling enforcement (GitHub, Conditional Access report-only mode, Salesforce profiles), add first, test with a routed and an unrouted browser, then enforce.

5. Keep a break-glass path

One admin account or profile that is not IP-restricted, with MFA, stored in a password manager. If a gateway region is unreachable you can still get in and adjust.

6. When you add a region or change gateways

Every new gateway region has its own IP. Add it to each allowlist, or use cloud firewall automation where the tool is a cloud firewall Reach can manage (Google Cloud, AWS, Azure, Cloudflare). For SaaS tools, keep a short list of where the IP lives — it's usually three or four places.

Per-tool guides

Common questions

The tool wants a range, not a single IP

Use the same address for start and end, or /32 in CIDR form. Both mean "exactly this address".

Members on mobile keep getting blocked

Their phones aren't routing the tool. The Reach Android and iOS apps route by domain — add the tool's domains to the mobile rules too (org policy pushes them).

Does the gateway IP ever change without warning?

No. Each region's exit IP is fixed. It only changes if a region is retired, which is announced in the changelog and reflected on the dashboard.