<a id="manage-ip-filters"></a>

# Manage IP Filters on Confluent Cloud

Use IP filters to enhance the security of your Confluent Cloud resources by
restricting access to trusted source IP addresses. IP filters use IP groups
to streamline the organization of [CIDR blocks](../../../_glossary.md#term-CIDR-block) into
meaningful groups of source IP addresses that can access your Confluent Cloud
resources. If an incoming IP address is associated with an allowed IP group,
access is granted; otherwise, access is denied. By using IP filters, you
can effectively enforce access control policies and help safeguard your
Confluent Cloud resources from unauthorized access.

IP filters only impact requests from outside Confluent Cloud
because they only restrict public access, not private networking access.
IP filters do not
impact requests from within Confluent Cloud such as cluster links or fully-managed
connectors.

## Prerequisites

To manage IP filters in the Confluent Cloud Console, you must meet the following
prerequisites:

* A Confluent Cloud account with the [OrganizationAdmin](../rbac/predefined-rbac-roles.md#organizationadmin-role) role to manage IP
  filters for your entire organization or the [EnvironmentAdmin](../rbac/predefined-rbac-roles.md#environmentadmin-role) role
  to manage IP filters for your environment.
* To use the `confluent iam ip-filter` CLI command, you must have
  Confluent CLI version 4.18.0 or later.

<a id="create-ip-filter"></a>

## Create an IP filter

IP filters allow access by referring to one or more IP groups, which define sets
of known IP addresses. To create an IP group, see [Create an IP group](manage-ip-groups.md#create-ip-group).

You must also specify the operation groups that your IP filter applies to. The
included operation groups define which operations the IP filter affects.
For details, see [Operation groups](overview.md#ip-filter-operation-groups).

#### IMPORTANT
The first IP filter you create, named `Management`, includes the operation
group for resource management and must include an IP group that covers the IP
address of your client.

You cannot make changes that would lock you out. If you create, update, or
delete an IP filter, or update an IP group, such that your calling IP address
would be blocked from making further changes, the request fails with an error.
For more details and a tip on how to specify a CIDR block
for your current IP address, see [Specify CIDR blocks for IP groups](manage-ip-groups.md#specify-cidr-blocks-for-ip-groups).

The lockout check evaluates the resource management operation group at
the organization and environment scope, so a change is rejected if your IP
address would be blocked at either scope.

You can add an IP filter to control access to your entire organization or to a
specific environment in your Confluent Cloud organization.
If you create an IP filter for a specific environment, it adds restrictions
specific to that environment while still enforcing any organization-level filters.
For details, see [Resource scopes](overview.md#resource-scopes).

### Confluent Cloud Console organization

1. Go to the **IP filtering** tab on the **Accounts & access** page
   at [https://confluent.cloud/settings/org/ip-filtering](https://confluent.cloud/settings/org/ip-filtering).

   The **IP filtering** page, with the **IP groups** view, appears.
2. Click **IP filters**. The IP filter view appears.
3. Click **Add IP filter**. The **Add IP filter** page appears.
4. In the **IP filters** field, enter a name for the IP filter.
5. In the **Access** section, select **Allow specific IP groups**.
6. In the **IP groups** field, select the IP groups that are allowed to
   access this resource. You must include at least one IP group.
7. In the **Operation groups** section, select the operation groups that
   are allowed to access this resource.
8. Click **Save and Enable**.

The IP filter is created and the **IP filters** view appears, listing
the IP filter name, operation groups, IP filter ID, and IP groups.

### Confluent Cloud Console environment

1. From your environment, go to **Network management** and then the
   **For public networks** tab.
   The **IP filtering** section appears.
2. Click **Add IP filter**. The **Add IP filter** page appears.
3. In the **IP filters** field, enter a name for the IP filter.
4. In the **Access** section, select **Allow specific IP groups**.
5. In the **IP groups** field, select the IP groups that are allowed to
   access this resource. You must include at least one IP group.
6. In the **Operation groups** section, select the operation groups that
   are allowed to access this resource.
7. Click **Save and Enable**.

The IP filter is created and the **IP filters** view appears, listing
the IP filter name, operation groups, IP filter ID, and IP groups.

### Confluent CLI organization

Use the `confluent iam ip-filter create` command
([Confluent CLI reference](https://docs.confluent.io/confluent-cli/current/command-reference/iam/ip-filter/confluent_iam_ip-filter_create.html))
to create an IP filter.

For example, the following command creates an IP filter named
`US Offices` that allows access to the `management`
operation group for the `ipg-12345` and `ipg-67890` IP groups. The
`--operations` flag is optional and defaults to the `management`
operation group.

```shell
confluent iam ip-filter create "US Offices" \
  --ip-groups ipg-12345,ipg-67890 \
  --operations management
```

The following example shows the response to the request:

```text
+------------------+-------------------------------------------------------------------------+
| ID               | ipf-abcde                                                               |
| Name             | US Offices                                                              |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-12345, ipg-67890                                                    |
| Operation Groups | MANAGEMENT                                                              |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3445-1865-4e27-9fe5-c23a58e96a10 |
+------------------+-------------------------------------------------------------------------+
```

#### NOTE
The `Resource Group` field shows “multiple” because the IP filter
uses the `Operation Groups` field to declare the operations it
covers. The Confluent CLI sends `multiple` unless you set
`--resource-group management`. `--resource-group` and
`--operations` are mutually exclusive.

The `Resource Scope` field shows that this IP filter applies to the
entire organization.

To add an IP filter that allows access to schema management in Confluent Cloud,
use the `confluent iam ip-filter create` command with the
appropriate flags.

```shell
confluent iam ip-filter create "schema management access" \
  --operations schema \
  --ip-groups ipg-123abc,ipg-456def
```

The following example shows the response to the request:

```text
+------------------+-------------------------------------------------------------------------+
| ID               | ipf-ek2le                                                               |
| Name             | schema management access                                                |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-123abc, ipg-456def                                                  |
| Operation Groups | SCHEMA                                                                  |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3445-1865-4e27-9fe5-c23a58e96a10 |
+------------------+-------------------------------------------------------------------------+
```

In this command:

* `schema management access` is the name of the IP filter you are creating.
* `--operations schema` specifies that the filter applies to schema management operations.
* `--ip-groups ipg-123abc,ipg-456def` lists the IP groups that are allowed access.

### Confluent CLI environment

To apply an IP filter to a specific environment, you can add the `--environment` parameter:

```shell
confluent iam ip-filter create "schema management access" \
  --environment env-987xyz \
  --operations schema \
  --ip-groups ipg-123abc,ipg-456def
```

If you do not specify an environment, the IP filter applies to the entire organization.

The following example shows the response to the request:

```text
+------------------+------------------------------------------------------------------------------------------------+
| ID               | ipf-3g793                                                                                      |
| Name             | schema management access                                                                       |
| Resource Group   | multiple                                                                                       |
| IP Groups        | ipg-123abc, ipg-456def                                                                         |
| Operation Groups | SCHEMA                                                                                         |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/environment=env-987xyz |
+------------------+------------------------------------------------------------------------------------------------+
```

The `Resource Scope` field shows the environment to which
this IP filter applies. Environment-level filters can only add additional
restrictions on top of organization-level filters, which act as your baseline
policy. Requests must satisfy both levels of filtering to be allowed access.

### Confluent Cloud APIs

To make a request to create an IP filter, use the `POST /iam/v2/ip-filters`
API endpoint. For more information, see
[Create an IP Filter](/cloud/current/api.html#tag/IP-Filters-(iamv2)/operation/createIamV2IpFilter).

#### NOTE
The `PATCH` method requires that you include all attributes in
the request body, not just the attributes that you want to update.

For example, the following request creates an IP filter named `US Offices`
that allows access to the `MANAGEMENT` operation group for the IP groups
`ipg-3rrky` and `ipg-wvppw`.

```shell
curl --request POST \
  --url https://api.confluent.cloud/iam/v2/ip-filters \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH' \
  --header 'content-type: application/json' \
  --data '{"filter_name":"US Offices","resource_group":"multiple","operation_groups":["MANAGEMENT"],"ip_groups":[{"id":"ipg-3rrky"},{"id":"ipg-wvppw"}]}'
```

These are the field values in this request:

* The `filter_name` field is the name of the IP filter. It is required.
* The `ip_groups` field is a required array of IP group references that
  are allowed access. Each entry sets `id` to an IP group ID. Provide
  between 1 and 25 IP groups.
* The `resource_group` field is required and must be set to `multiple`
  to indicate to use the `operation_groups` for the IP filter.
* The `operation_groups` field is required when `resource_group` is
  `multiple` and must list at least one operation group. See
  [Identifiers](overview.md#operation-group-identifiers).
* The `resource_scope` field is optional and defaults to the organization.
  If you specify an environment, the IP filter applies to that environment.

The following example shows the response to the request:

```json
{
  "api_version": "iam/v2",
  "filter_name": "US Offices",
  "id": "ipf-3zpje",
  "ip_groups": [
    {
      "id": "ipg-3rrky",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-3rrky",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-3rrky"
    },
    {
      "id": "ipg-wvppw",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-wvppw",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-wvppw"
    }
  ],
  "kind": "IpFilter",
  "metadata": {
    "created_at": "2025-03-15T22:34:02.906282Z",
    "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-3zpje",
    "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-3zpje",
    "updated_at": "2025-03-15T22:34:02.906282Z"
  },
  "operation_groups": [
    "MANAGEMENT"
  ],
  "resource_group": "multiple",
  "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
}
```

### Terraform

Create an IP filter by using the Confluent Terraform provider. For more
information, see [confluent_ip_filter Resource](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_ip_filter).

<a id="use-no-public-networks-group"></a>

## Block all public networks

Blocking all public networks prevents access from any public network for
the defined operation groups. When creating your IP filter, you can select
**Block all public networks** for access. Select this option
using any of the following interfaces:

### Confluent Cloud Console organization

1. Go to the **IP filtering** tab on the **Accounts & access** page
   at [https://confluent.cloud/settings/org/ip-filtering](https://confluent.cloud/settings/org/ip-filtering).

   The **IP filtering** page, with the **IP groups** view, appears.
2. Click **IP filters**. The IP filter view appears.
3. Click **Add IP filter**. The **Add IP filter** page appears.
4. In the **IP filters** field, enter a name for the IP filter.
5. In the **Access** section, select **No public networks**.

   This option excludes all public IP addresses, allowing access only from
   private network connections.
   * To allow no public network access, use this option with only one IP
     filter per operation group.
   * When you select **No public networks**, you can’t also select specific
     IP groups.
6. In the **Operation groups** section, select the operation groups that
   are allowed to access this resource.
7. Click **Save and Enable**.

The IP filter is created and the **IP filters** view appears, listing
the IP filter name, operation groups, IP filter ID, and IP groups.

### Confluent Cloud Console environment

1. From your environment, go to **Network management** and then the **For public networks** tab.
   The **IP filtering** section appears.
2. Click **Add IP filter**. The **Add IP filter** page appears.
3. In the **IP filters** field, enter a name for the IP filter.
4. In the **Access** section, select **No public networks**.

   This option excludes all public IP addresses, allowing access only from
   private network connections.
   * To allow no public network access, use this option with only one IP
     filter per operation group.
   * When you select **No public networks**, you can’t also select specific
     IP groups.
5. In the **Operation groups** section, select the operation groups that
   are allowed to access this resource.
6. Click **Save and Enable**.

The IP filter is created and the **IP filters** view appears, listing
the IP filter name, operation groups, IP filter ID, and IP groups.

### Confluent CLI

To prevent access from public networks, use the `--no-public-networks`
flag. The following example shows how to
create an IP filter that prevents access from public networks, but allows
access to the `schema` operation group:

```shell
confluent iam ip-filter create "No Public Access" \
  --no-public-networks \
  --operations schema
```

The following example shows the response to the request:

```text
+------------------+-------------------------------------------------------------------------+
| ID               | ipf-wjqxe                                                               |
| Name             | No Public Access                                                        |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-none                                                                |
| Operation Groups | SCHEMA                                                                  |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01 |
+------------------+-------------------------------------------------------------------------+
```

#### NOTE
These are the field values in this response:

* The `Resource Group` field shows “multiple” because the IP filter
  uses the `Operation Groups` field to declare the operations it
  covers.
* The `Resource Scope` field shows that this IP filter applies to the
  entire organization.
* The `IP Groups` field shows “ipg-none”, which is the predefined IP
  group that prevents access from public networks.
* The `Operation Groups` field shows “SCHEMA” because the IP filter
  applies to the `schema` operation group. The `Operation Groups`
  field might not include the “management” operation group when you use the
  `--no-public-networks` flag because it would block all access to manage
  your own Confluent Cloud organization.

### Confluent Cloud APIs

To prevent access from public networks, set the only `ip_groups` entry
to the system-defined `ipg-none` IP group.

```shell
curl --request POST \
  --url https://api.confluent.cloud/iam/v2/ip-filters \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH' \
  --header 'content-type: application/json' \
  --data '{"filter_name":"No Public Access","resource_group":"multiple","operation_groups":["SCHEMA"],"ip_groups":[{"id":"ipg-none"}]}'
```

These are the field values in this request:

* The `ip_groups` field contains a single entry whose `id` is
  `ipg-none`. You can’t combine `ipg-none` with any other IP group in
  the same IP filter.
* The `operation_groups` field can’t include `MANAGEMENT` when you use
  `ipg-none`.
* The `resource_group` field is required and must be set to `multiple`
  to indicate to use the `operation_groups` for the IP filter.
* The `resource_scope` field is optional and defaults to the organization.
  If you specify an environment, the IP filter applies to that environment.

The following example shows the response to the request:

```json
{
  "api_version": "iam/v2",
  "filter_name": "No Public Access",
  "id": "ipf-3zpje",
  "ip_groups": [
    {
      "id": "ipg-none",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-none",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-none"
    }
  ],
  "kind": "IpFilter",
  "metadata": {
    "created_at": "2025-03-15T22:34:02.906282Z",
    "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-3zpje",
    "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-3zpje",
    "updated_at": "2025-03-15T22:34:02.906282Z"
  },
  "operation_groups": [
    "SCHEMA"
  ],
  "resource_group": "multiple",
  "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
}
```

When you create an IP filter that blocks all public networks, the following
constraints apply:

* For each operation group, an IP filter that blocks all public networks cannot
  be combined with any other IP filters.
* When blocking all public networks, you cannot include any other IP group in the same IP filter.
* You cannot block all public networks for the **Management** operation
  group because it doesn’t support private networking. This protects you
  from blocking all access.

<a id="update-ip-filter"></a>

## Update an IP filter

### Confluent Cloud Console

1. Go to the **IP filtering** tab on the **Accounts & access** page
   at [https://confluent.cloud/settings/org/ip-filtering](https://confluent.cloud/settings/org/ip-filtering).

   The IP filtering page, with the **IP groups** view, appears.
2. Click **IP filters**. The IP filter view appears.

#. In the table of IP filters, click the name of the IP filter that you
want to update. The IP filter details page appears.

1. Click **Edit IP filter**. The IP filter fields appear.
2. Edit the values of your **IP filter name**, **IP groups**, and **Operation groups**,
   as needed, and click **Save**.

The IP filter is updated and the updated IP filters list reappears.

### Confluent CLI

Use the `confluent iam ip-filter update` command
([Confluent CLI reference](https://docs.confluent.io/confluent-cli/current/command-reference/iam/ip-filter/confluent_iam_ip-filter_update.html))
to update an IP filter. You must specify at least one of the following
flags:

* `--name`: A new name for the IP filter.
* `--add-ip-groups` and `--remove-ip-groups`: A comma-separated list
  of IP groups to add to or remove from the IP filter.
* `--add-operation-groups` and `--remove-operation-groups`: A
  comma-separated list of operation groups to add to or remove from the
  IP filter.
* `--resource-group`: The resource group, either `management` or
  `multiple`.

You can’t change the resource scope of an existing IP filter. The resource
scope is immutable after the IP filter is created.

For example, the following command updates the name of the IP filter
to `India Offices`.

```shell
confluent iam ip-filter update ipf-abcef \
  --name "India Offices"
```

The following example shows the response to the request:

```text
+------------------+-------------------------------------------------------------------------+
| ID               | ipf-abcef                                                               |
| Name             | India Offices                                                           |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-3rrky, ipg-wvppw                                                    |
| Operation Groups | MANAGEMENT                                                              |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01 |
+------------------+-------------------------------------------------------------------------+
```

In this example, the IP filter is updated to show the name `India Offices`.

The following command adds an IP group and the `SCHEMA` operation group
to the same IP filter:

```shell
confluent iam ip-filter update ipf-abcef \
  --add-ip-groups ipg-4abcd \
  --add-operation-groups SCHEMA
```

You can’t remove every IP group from an IP filter. If you do, the command
fails with `Cannot remove all IP groups from IP filter`.

### Confluent Cloud APIs

To make a request to update an IP filter, use the `PATCH /iam/v2/ip-filters/{id}` API endpoint (see
[Update an IP Filter](/cloud/current/api.html#tag/IP-Filters-(iamv2)/operation/updateIamV2IpFilter)).

For example, the following request updates the name of the IP filter
to `India Offices`.

```shell
curl --request PATCH \
  --url 'https://api.confluent.cloud/iam/v2/ip-filters/ipf-abcef' \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH' \
  --header 'content-type: application/json' \
  --data '{"filter_name":"India Offices","resource_group":"multiple","operation_groups":["MANAGEMENT"],"ip_groups":[{"id":"ipg-3rrky"},{"id":"ipg-wvppw"}]}'
```

These are the field values in this request:

* The `ip_groups` field replaces the existing list of IP groups. Include
  every IP group that the IP filter should reference, not only the ones
  you are adding.
* The `operation_groups` field also replaces the existing list. Omit the
  field to leave the operation groups unchanged. An empty list isn’t
  supported.
* The `resource_scope` field can’t be updated. The resource scope is
  immutable after the IP filter is created.

The following example shows the response to the request, with the updated
filter name `India Offices`:

```json
{
  "api_version": "iam/v2",
  "filter_name": "India Offices",
  "id": "ipf-abcef",
  "ip_groups": [
    {
      "id": "ipg-3rrky",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-3rrky",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-3rrky"
    },
    {
      "id": "ipg-wvppw",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-wvppw",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-wvppw"
    }
  ],
  "kind": "IpFilter",
  "metadata": {
    "created_at": "2025-03-15T22:44:19.045344Z",
    "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-abcef",
    "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-abcef",
    "updated_at": "2025-03-15T23:04:17.982376Z"
  },
  "operation_groups": [
    "MANAGEMENT"
  ],
  "resource_group": "multiple",
  "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
}
```

<a id="describe-ip-filter"></a>

## Describe an IP filter

### Confluent Cloud Console

1. Go to the **IP filtering** tab on the **Accounts & access** page
   at [https://confluent.cloud/settings/org/ip-filtering](https://confluent.cloud/settings/org/ip-filtering).

   The IP filtering page, with the **IP groups** view, appears.
2. Click **IP filters**. The IP filters view appears.
3. Click the name of the IP filter that you want to view. The IP filter
   details page appears, showing the IP filter name, IP filter ID, and
   IP groups.

To return to the list of IP filters, click “IP filtering” in the breadcrumb
navigation at the top of the page.

### Confluent CLI

Use the `confluent iam ip-filter describe` command
([Confluent CLI reference](https://docs.confluent.io/confluent-cli/current/command-reference/iam/ip-filter/confluent_iam_ip-filter_describe.html))
to describe a IP filter. For example, the following command shows the
details about the `ipf-abcef` IP filter:

```shell
confluent iam ip-filter describe ipf-abcef
```

The following example shows the response to the request:

```text
+------------------+-------------------------------------------------------------------------+
| ID               | ipf-abcef                                                               |
| Name             | India Offices                                                           |
| Resource Group   | multiple                                                                |
| IP Groups        | ipg-3rrky, ipg-wvppw                                                    |
| Operation Groups | MANAGEMENT                                                              |
| Resource Scope   | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01 |
+------------------+-------------------------------------------------------------------------+
```

### Confluent Cloud APIs

To describe an IP filter, use the `GET /iam/v2/ip-filters/{id}` API endpoint (see
[Read an IP Filter](/cloud/current/api.html#tag/IP-Filters-(iamv2)/operation/getIamV2IpFilter)).

For example, the following request describes the `ipf-abcef` IP filter:

```shell
curl --request GET \
  --url 'https://api.confluent.cloud/iam/v2/ip-filters/ipf-abcef' \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH'
```

The following example shows the response to the request:

```json
{
  "api_version": "iam/v2",
  "filter_name": "India Offices",
  "id": "ipf-abcef",
  "ip_groups": [
    {
      "id": "ipg-3rrky",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-3rrky",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-3rrky"
    },
    {
      "id": "ipg-wvppw",
      "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-wvppw",
      "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-wvppw"
    }
  ],
  "kind": "IpFilter",
  "metadata": {
    "created_at": "2025-03-15T22:44:19.045344Z",
    "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-abcef",
    "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-abcef",
    "updated_at": "2025-03-15T23:04:17.982376Z"
  },
  "operation_groups": [
    "MANAGEMENT"
  ],
  "resource_group": "multiple",
  "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
}
```

<a id="list-ip-filter"></a>

## List IP filters

### Confluent Cloud Console

1. Go to the **IP filtering** tab on the **Accounts & access** page
   at [https://confluent.cloud/settings/org/ip-filtering](https://confluent.cloud/settings/org/ip-filtering).

   The IP filtering page, with the **IP groups** view, appears.
2. Click **IP filters**. The IP filters view appears.

You can click an IP filter name to view the details.

### Confluent CLI

Use the `confluent iam ip-filter list` command
([Confluent CLI reference](https://docs.confluent.io/confluent-cli/current/command-reference/iam/ip-filter/confluent_iam_ip-filter_list.html))
to list the IP filters in your organization.

For example, the following command lists the IP filters.

```shell
confluent iam ip-filter list
```

The following example shows the response to the request:

```text
     ID     |    Name       | Resource Group |      IP Groups       | Operation Groups |                             Resource Scope
------------+---------------+----------------+----------------------+------------------+--------------------------------------------------------------------------
  ipf-abcef | India Offices | multiple       | ipg-3rrky, ipg-wvppw | MANAGEMENT       | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01
  ipf-xyz12 | US Offices    | multiple       | ipg-4abcd            | MANAGEMENT       | crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01
```

To list the IP filters for a specific environment, use the
`--environment` flag. Add the `--include-parent-scopes` flag to also
include the IP filters that are scoped to the organization that contains
the environment.

```shell
confluent iam ip-filter list \
  --environment env-abc123 \
  --include-parent-scopes
```

### Confluent Cloud APIs

To retrieve a list of the IP filters, use the `GET /iam/v2/ip-filters` API endpoint (see
[List of IP Filters](/cloud/current/api.html#tag/IP-Filters-(iamv2)/operation/listIamV2IpFilters)).

For example, the following request lists the IP filters:

```shell
curl --request GET --url https://api.confluent.cloud/iam/v2/ip-filters \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH'
```

You can add the following query parameters to the request:

* `resource_scope`: The CRN of the resource scope to list IP filters for.
* `include_parent_scopes`: Set to `true` to also return the IP filters
  that are scoped to the parents of the specified resource scope.
* `page_size`: The number of IP filters to return per page. The default
  is 25 and the maximum is 100.
* `page_token`: The opaque token that identifies the next page of
  results. Use the value from `metadata.next` in the previous response.

The following example shows the response to the request:

```json
{
  "api_version": "iam/v2",
  "data": [
    {
      "filter_name": "India Offices",
      "id": "ipf-abcef",
      "ip_groups": [
        {
          "id": "ipg-3rrky",
          "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-3rrky",
          "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-3rrky"
        },
        {
          "id": "ipg-wvppw",
          "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-wvppw",
          "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-wvppw"
        }
      ],
      "metadata": {
        "created_at": "2025-03-15T22:44:19.045344Z",
        "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-abcef",
        "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-abcef",
        "updated_at": "2025-03-15T23:04:17.982376Z"
      },
      "operation_groups": [
        "MANAGEMENT"
      ],
      "resource_group": "multiple",
      "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
    },
    {
      "filter_name": "US Offices",
      "id": "ipf-xyz12",
      "ip_groups": [
        {
          "id": "ipg-4abcd",
          "related": "https://confluent.cloud/iam/v2/ip-groups/ipg-4abcd",
          "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-group=ipg-4abcd"
        }
      ],
      "metadata": {
        "created_at": "2025-03-15T22:44:19.045344Z",
        "resource_name": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01/ip-filter=ipf-xyz12",
        "self": "https://confluent.cloud/iam/v2/ip-filters/ipf-xyz12",
        "updated_at": "2025-03-15T23:04:17.982376Z"
      },
      "operation_groups": [
        "MANAGEMENT"
      ],
      "resource_group": "multiple",
      "resource_scope": "crn://confluent.cloud/organization=c9bc3446-0754-4d26-9fe5-c24a58e96a01"
    }
  ],
  "kind": "IpFilterList",
  "metadata": {
    "first": "https://confluent.cloud/iam/v2/ip-filters",
    "next": ""
  }
}
```

<a id="delete-ip-filter"></a>

## Delete an IP filter

IP filters can be deleted to remove access to Confluent Cloud resources. You can also
[update an IP filter](#update-ip-filter) to remove an IP group from access.

#### IMPORTANT
Deleting an IP filter removes the IP filter from your organization. If you
delete an IP filter that is assigned to a network, the IP addresses in that
network can no longer access the resources that the IP filter controls.

If all IP filters are removed, authorized users from any source IP address
can access resources in your organization.

### Confluent Cloud Console

1. Go to the **IP filtering** tab on the **Accounts & access** page
   at [https://confluent.cloud/settings/org/ip-filtering](https://confluent.cloud/settings/org/ip-filtering).

   The **IP filtering** page, with the **IP group** view, appears.
2. Click **IP filter**. The **IP filter** view appears.
3. Click the IP filter name for the IP filter you want to delete. The IP
   filter details page appears.
4. Click **Delete IP filter**. The **Delete IP filter** dialog appears.
5. After confirming that you want to delete the specified IP filter, enter
   the IP filter name in the **IP filter name** field and click **Confirm**.

The IP filter is deleted and the **Accounts & access** page appears
listing the remaining IP filters.

### Confluent CLI

Use the `confluent iam ip-filter delete` command
([Confluent CLI reference](https://docs.confluent.io/confluent-cli/current/command-reference/iam/ip-filter/confluent_iam_ip-filter_delete.html#))
to delete an IP filter. For example, the following command deletes
the `ipf-9876` IP filter:

```shell
confluent iam ip-filter delete ipf-9876
```

The command prompts you to confirm the deletion and then shows the
following response:

```text
Deleted IP filter "ipf-9876".
```

You can pass more than one IP filter ID to delete several IP filters in a
single command.

### Confluent Cloud APIs

To make a request to delete an IP filter, use the `DELETE /iam/v2/ip-filters/{id}` API endpoint (see
[Delete an IP Filter](/cloud/current/api.html#tag/IP-Filters-(iamv2)/operation/deleteIamV2IpFilter)).

For example, the following request deletes the `ipf-9876` IP filter:

```shell
curl --request DELETE \
  --url 'https://api.confluent.cloud/iam/v2/ip-filters/ipf-9876' \
  --header 'Authorization: Basic REPLACE_BASIC_AUTH'
```

A successful request returns `204 No Content` with an empty response
body. You can verify that the IP filter was deleted by running the
`confluent iam ip-filter list` command.

<a id="ip-filter-limits"></a>

## IP filter limits

Confluent Cloud enforces the following limits on IP filters:

| Limit                       | Value                                                                                                                                     |
|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| IP filters per organization | 25                                                                                                                                        |
| IP groups per IP filter     | 1 minimum, 25 maximum                                                                                                                     |
| IP filter name length       | 1 to 64 characters                                                                                                                        |
| IP filter name characters   | Letters, numbers, the space character, and the following special<br/>characters: `[`, `]`, `|`, `&`, `+`, `-`, `_`, `/`,<br/>`.`, and `,` |
| IP filter name uniqueness   | Names must be unique within your organization                                                                                             |
| Resource scope              | Organization or environment level only. The resource scope is set when<br/>you create the IP filter and can’t be changed afterward.       |
| Operation groups            | Required when `resource_group` is `multiple`. At least one operation<br/>group must be present; an empty list isn’t supported.            |

<a id="ip-filter-failure-modes"></a>

## IP filter errors

The following table lists the errors that Confluent Cloud returns for IP filter
operations and how to resolve them.

| Operation                   | Error                                                                                                                                                                                        | Resolution                                                                                                                                                                                                                                                                                                                      |
|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Create, Update              | `filter_name cannot be empty`, `filter_name must be less than or<br/>equal to 64 characters`, or `filter_name can only contain letters,<br/>numbers, spaces, and certain special characters` | Provide a name that meets the constraints in [IP filter limits](#ip-filter-limits).                                                                                                                                                                                                                                             |
| Create, Update              | `an IP filter with this filter_name already exists` (HTTP `409`)                                                                                                                             | Choose a name that isn’t already used by another IP filter in your<br/>organization.                                                                                                                                                                                                                                            |
| Create, Update              | `IP group does not exist`                                                                                                                                                                    | Verify the IP group IDs with `confluent iam ip-group list`.                                                                                                                                                                                                                                                                     |
| Create, Update              | `your input contains multiple copies of the same IP Group:<br/><ip-group-id>`                                                                                                                | Remove the repeated IP group from the request.                                                                                                                                                                                                                                                                                  |
| Create, Update              | `an IP Filter can have at most 25 IP Groups`                                                                                                                                                 | Reduce the number of IP groups, or consolidate CIDR blocks into fewer IP<br/>groups.                                                                                                                                                                                                                                            |
| Create, Update              | `Resource Group multiple indicates minimum one operation group.`                                                                                                                             | Include at least one operation group. See<br/>[Operation groups](overview.md#ip-filter-operation-groups).                                                                                                                                                                                                                       |
| Create, Update              | `Resource Group is not supported`                                                                                                                                                            | Use either `management` or `multiple` for the resource group.                                                                                                                                                                                                                                                                   |
| Create, Update              | `Operation Group is not supported`                                                                                                                                                           | Use a supported operation group. See [Operation groups](overview.md#ip-filter-operation-groups).                                                                                                                                                                                                                                |
| Create, Update              | `This IP Filter cannot have more than one IP group associated since the<br/>No Public Networks group has already been added here.`                                                           | The `ipg-none` IP group can’t be combined with any other IP group. See<br/>[Block all public networks](#use-no-public-networks-group).                                                                                                                                                                                          |
| Create, Update              | `Invalid resource or operation group for the IP Group: No Public<br/>Networks.`                                                                                                              | The `ipg-none` IP group can’t be used with the resource management<br/>operation group.                                                                                                                                                                                                                                         |
| Create, Update              | `Management Operation Group does not support an environment level<br/>resource scope: '<crn>'`                                                                                               | Create the IP filter at the organization scope, or remove the<br/>`MANAGEMENT` operation group from the environment-scoped IP filter.                                                                                                                                                                                           |
| Create, Update              | `Invalid resource scope '<crn>'`, `Must be either organization or<br/>environment level`, or `Cannot find resource matching ...`                                                             | Provide a valid organization or environment CRN for a resource that<br/>exists in your organization. See [Resource scopes](overview.md#resource-scopes).                                                                                                                                                                        |
| Create                      | `IP Filter quota exceeded` (HTTP `402`)                                                                                                                                                      | Delete an unused IP filter. Your organization can have at most 25 IP<br/>filters.                                                                                                                                                                                                                                               |
| Create, Update, Delete      | `this action would lock out the requester from IP address<br/><ip-address>`                                                                                                                  | The change would block your own IP address from managing your<br/>organization. Retry from an IP address that the resulting IP filters<br/>permit, or include an IP group that covers your current IP address. For<br/>details, see [Specify CIDR blocks for IP groups](manage-ip-groups.md#specify-cidr-blocks-for-ip-groups). |
| Update                      | `Resource Scope cannot be updated and is immutable.`                                                                                                                                         | Delete the IP filter and create a new one with the resource scope that<br/>you want.                                                                                                                                                                                                                                            |
| Update                      | `Operation groups exist for this filter and are not compatible with<br/>requested change` (HTTP `409`)                                                                                       | You can’t change an IP filter that uses operation groups to<br/>`resource_group: management`. Update the operation groups instead.                                                                                                                                                                                              |
| Update (Confluent CLI only) | `Cannot remove all IP groups from IP filter`                                                                                                                                                 | An IP filter must reference at least one IP group. Delete the IP filter<br/>instead, or add a replacement IP group in the same command.                                                                                                                                                                                         |
| Describe, Update, Delete    | `IP filter not found` (HTTP `404`)                                                                                                                                                           | Verify the IP filter ID with `confluent iam ip-filter list`.                                                                                                                                                                                                                                                                    |
| All                         | `user_unauthorized` (HTTP `403`)                                                                                                                                                             | You need the [OrganizationAdmin](../rbac/predefined-rbac-roles.md#organizationadmin-role) role to manage<br/>organization-scoped IP filters, or the [EnvironmentAdmin](../rbac/predefined-rbac-roles.md#environmentadmin-role) role<br/>for environment-scoped IP filters.                                                      |
| All                         | HTTP `429`                                                                                                                                                                                   | You exceeded the API rate limit. Wait for the number of seconds in the<br/>`Retry-After` response header and retry.                                                                                                                                                                                                             |

## Related content

* [IP Filtering (overview)](overview.md#ip-filtering)
* [Manage IP Groups](manage-ip-groups.md#manage-ip-groups)
* [Best Practices for IP Filtering](best-practices.md#ip-filtering-best-practices)
* [Confluent CLI Reference: confluent iam
  ip-filter](https://docs.confluent.io/confluent-cli/current/command-reference/iam/ip-filter/index.html)
* [Confluent CLI Reference: confluent iam
  ip-group](https://docs.confluent.io/confluent-cli/current/command-reference/iam/ip-group/index.html)
* [Confluent API Reference: IP Filters](/cloud/current/api.html#tag/IP-Filters-(iamv2))
* [Confluent API Reference: IP Groups](/cloud/current/api.html#tag/IP-Groups-(iamv2))