Allowlist your gateway IP in Salesforce

Salesforce has two separate IP-range settings that people mix up. Trusted IP Ranges (org-wide) let logins from those addresses skip the email/SMS identity check and the API security token. Login IP Ranges on a profile are a hard restriction: users on that profile can only log in from those addresses. With every team member exiting from the same Reach gateway IP, both become a single /32 entry you set once.

Before you start

Copy the gateway IP from your Reach dashboard (Organisation → Gateway). If your team uses more than one region, note every IP — Salesforce needs each as its own range (start and end address the same).

Trusted IP Ranges (org-wide, skips verification)

  1. Setup → Quick Find → "Network Access" (under Security).
  2. New, enter the gateway IP as both Start IP Address and End IP Address.
  3. Save. Repeat per gateway region.

Effect: logins routed through Reach no longer trigger the "verify your identity" prompt, and API integrations from that IP don't need the security token appended to the password. Logins from elsewhere are still allowed, just challenged.

Login IP Ranges (per profile, hard restriction)

  1. Setup → Quick Find → "Profiles", open the profile (e.g. Standard User).
  2. In the Login IP Ranges section, New; enter the gateway IP as start and end, add a description such as TYO Reach gateway. Save.
  3. Repeat for each profile that should be locked to Reach, and for each gateway region.

Effect: users on that profile cannot log in unless their browser is routed through Reach. Make sure the admin profile you're using either keeps an unrestricted range or includes the IP you're connecting from — Salesforce will happily lock out an admin.

Make sure Salesforce is routed through Reach

Login IP Ranges only help if the browser actually exits through the gateway. Add salesforce.com, force.com, my.salesforce.com and lightning.force.com (plus your org's custom domain) to your organisation's routing policy so members can't accidentally open Salesforce on their home IP — see Group policy.

Common questions

Which one should I use?

Use Login IP Ranges on profiles when the goal is "only reachable via Reach". Use Trusted IP Ranges when you just want to stop the verification prompts. Many orgs use both.

Does this cover the Salesforce mobile app?

Login IP Ranges apply to the mobile app too — it will be blocked unless the phone is routed through Reach (the Android/iOS apps route by domain). Decide whether that's what you want before enabling it on a profile with field staff.

We added a new Reach region — what changes?

Add the new region's gateway IP to the same settings. Existing entries stay valid.

Source: Set Trusted IP Ranges for Your Org · Restrict Login IP Addresses in Profiles