Restrict when and where your team can connect
An organisation access policy lets you decide the conditions under which members can use Reach at all: which countries they can connect from, which IP ranges, which hours of the day, and whether the device must be one Reach already trusts. It's enforced at the gateway on every connection, so a member outside the policy genuinely can't route traffic — they don't just fail an app login.
Where to set it
In your admin dashboard open the organisation, go to the Gateways tab, and tick Access policy. Fill in the constraints you want, then click Save Gateway Settings. Leave any constraint empty to not use it.
| Setting | What it does | Notes |
|---|---|---|
| Allowed countries | Only connections from these countries are accepted | ISO codes, e.g. AU, NZ. Empty = no country restriction. |
| Allowed IP ranges | Only connections from these CIDR ranges are accepted | e.g. 203.0.113.0/24 for an office line. Empty = no IP restriction. |
| Restrict to office hours | Only connections inside the window are accepted | Pick days (Mon–Sun), a from/to time and a timezone such as Australia/Sydney. Defaults to Mon–Fri 09:00–17:00. |
| Require a trusted device | Only devices Reach already knows for that member are accepted | See Members & devices for how a device becomes trusted. |
Every constraint you fill in must be satisfied — a member connecting from an allowed country but outside office hours is still blocked.
How it's enforced
The gateway evaluates the policy per connection, not once at sign-in:
- Country comes from the connection's source address as seen by the gateway's edge network.
- IP range is checked against the member's real public IP.
- Office hours are evaluated in the timezone you set, with days numbered Monday to Sunday and the window inclusive of both times.
- Trusted device compares the identifier the client presents with the member's list of trusted devices.
A blocked connection is refused at the gateway with a reason — region, network, hours or device. The mobile apps show a banner when access is restricted; on desktop the routed apps can't reach the gateway until the member is back inside the policy.
Members who belong to more than one organisation
If a member is in several organisations with enabled policies, the strictest rule from every policy applies:
- their country must be in every organisation's allowed list;
- their IP must fall inside a range from every organisation that sets ranges;
- the time must be inside office hours for every organisation that sets hours;
- a trusted device is required if any organisation requires one.
A lax or disabled policy in one organisation can never loosen a strict policy in another.
Access policy vs IP access rules
Reach also has per-account IP access rules — allow and deny lists that decide which destinations a member may reach through the gateway (see IP allowlisting & cloud firewall). The access policy on this page is about the member's own location, time and device. They're independent and can be combined.
Common questions
Does the policy apply to the organisation owner?
Yes — it applies to everyone whose Reach key belongs to the organisation, including the owner. Test a new policy from an allowed location before tightening it.
What happens to an active session when office hours end?
New connections are refused once the window closes. Because the policy is checked per connection, an already-open stream isn't cut mid-transfer, but the next request from that app is blocked.
Can I allow a member to work from overseas temporarily?
Add the country (or their IP range) to the policy for the trip, then remove it. There's no per-member exception yet; a member who needs a permanently different policy is best placed in a separate organisation.
Related
- Members & devices — trusted devices and offboarding
- Team gateways — which gateways members can use
- SSO & MFA — require MFA for the whole team