IP Group

8/3/26About 4 min

IP Group

1 Overview

An IP group is a reusable IP set shared across sites. Maintain a batch of IPs in one group, then have the IP Blacklist, IP Whitelist and Protection Rules reference that group — instead of re-entering the same IPs on every site.

Typical cases: office egress ranges, ops jump hosts, monitoring/health-check sources, known scanner ranges — sets that need to apply on several sites at once and have to be kept in sync whenever they change.

Notice at the top of the page: An IP group is a reusable IP set shared across sites. Block/allow lists and custom rules can reference it; changes to a group take effect immediately on every referencing site (including the global site), no restart needed.

Tips

Group changes take effect immediately: after adding or removing IPs in a group, every referencing site (including the global site) changes its verdict at the same instant. No need to re-save each site, and no need to restart SamWaf.

2 Steps

2.1 Create an IP group

Go to Website Protection → IP Group and click New IP Group in the top-left corner.
Fill in Group Name (required). The name is unique within the system, and protection rules can reference the group by this name.
Optionally fill in Remarks.
Click Confirm to save.

The Group Code is generated by the system — you do not enter it when creating a group. It is the internal identifier that block/allow lists and rules use to reference the group; it cannot be changed after creation and is shown read-only in the list and the edit dialog.

2.2 Maintain the IPs in a group

Click Manage IPs in the Operation column of a row; the Manage IPs in Group panel slides out on the right.

Add IP: add entries one at a time. Fill in the IP and remarks, then confirm.
Bulk Add: paste multi-line text, one IP per line. Blank lines and lines starting with # are ignored.
Bulk Delete: select rows with the checkboxes first (the button is disabled with nothing selected).
Clear Group: remove all IPs in the group — the group itself is kept (asks for confirmation).
The top-right of the panel supports fuzzy search by IP fragment.

After a bulk add, a Bulk Add Result dialog reports "N added, N skipped (already present), N invalid". If any lines are invalid, the dialog lists Line / Content / Reason for each so you can pinpoint them; the remaining valid lines are unaffected and are saved normally.

Need a daily automatic sync?

"Bulk Add" is a one-off manual paste. When the IPs come from a file or a remote subscription source that keeps changing, use a scheduled import instead: a Scheduled Import (Batch Task) link is available both on the right of the notice bar at the top of the page and in the toolbar of this panel. It jumps to the Batch Tasks page where you can create a task of type "Import into IP Group". When you jump from this panel, the current group is carried over and pre-selected in the new-task dialog.

2.3 Supported IP syntax

Group entries use the same syntax as the block/allow lists:

Syntax	Example	Notes
Single IP	`1.2.3.4`, `2001:db8::1`	IPv4 and IPv6 both supported
CIDR	`1.2.3.0/24`, `2001:db8::/32`
IPv4 wildcard	`10.10..`, `10..1.`	Per octet; `*` may appear in any position
IPv6 wildcard	`2001:db8::::::`	Per group; all 8 groups must be spelled out and `::` shorthand cannot be mixed in
Range	`1.2.3.4-1.2.3.99`	Inclusive on both ends; start and end must both be IPv4 or both IPv6

Warning

Patterns that match every IP — such as *.*.*.* and 0.0.0.0-255.255.255.255 — are rejected on save. In a whitelist that would leave the site completely unprotected; in a blacklist it would ban every visitor. If you really need to match everything, write 0.0.0.0/0 explicitly so the intent is unmistakable.

2.4 Edit / delete an IP group

Edit: you can change Group Name and Remarks. The Group Code cannot be changed (block/allow lists and rules reference the group by it).
Delete: if the group is referenced by any block or allow list, the dialog shows "This group is referenced by N block-list and M allow-list entries across X site(s)" together with the affected sites, and the Confirm button stays disabled until you tick I understand, delete the referencing entries too.

Warning

A forced delete also removes the referencing block/allow list entries, and cannot be undone. Deleting a group referenced by a whitelist may instantly revoke the exemption of ops IPs; deleting one referenced by a blacklist instantly un-bans the IPs it covered. Read the affected-site list carefully before confirming.

2.5 Search

The top-right of the page supports fuzzy filtering by Group Name; enter a value and click Search.

3 Referencing a group from block/allow lists

In the create/edit dialog of the IP Blacklist or IP Whitelist, switch Entry Type to Reference IP Group and pick the target group from the IP Group dropdown. Options are shown as "Group Name (entry count)", and the Manage IP Groups link next to it jumps straight to this page.

4 Referencing a group from protection rules

In the manual code mode of Protection Rules, use RF.IPInGroup to reference an IP group:

rule Rip_group_demo "Reference an IP group" salience 100 {
    when
        RF.IPInGroup(MF.SRC_IP, "office-egress") == true
    then
        RF.Allow();
}

The second argument accepts either the group name or the group code. Rule verdicts also change immediately when the group content changes.

Tips

The top of the "Manage IPs in Group" panel shows a ready-to-copy reference snippet for the current group.

5 Field reference

Field	Description
Group Name	Name of the IP group; required on create/edit, unique within the system; rules can reference the group by it
Group Code	System-generated internal identifier, immutable after creation; block/allow lists and rules reference the group by it
Entries	Number of IPs currently in the group (shown in the list)
Remarks	Free-form notes, optional
Create Time	When the record was created (shown in the list, generated automatically)

Fields of an entry inside a group:

Field	Description
IP	A single IP, CIDR, wildcard or range — see 2.3
Remarks	Free-form notes, optional
Create Time	When the record was created (shown in the list, generated automatically)

6 FAQ

I changed the IPs in a group but the site is unaffected. Group content takes effect immediately — no restart, and no need to re-save the block/allow list. If it still has no effect, check that the site's block/allow list really contains a "Reference IP Group" entry, and that the global site's protection status is enabled (the global site's lists only participate when its protection is on).
Why is Block Layer greyed out after I choose "Reference IP Group"? Entries that reference an IP group, or that use wildcard/range syntax, can only apply at the WAF App Layer. The system firewall (iptables / netsh) only understands single IPs and CIDR ranges and cannot express these forms.
RF.IPInGroup never matches in my rule. First make sure the rule uses manual code mode (the visual builder does not support RF. functions). Then check that the group name matches exactly (including spaces), or reference the group by its group code instead.
How many sites can reference one IP group? There is no limit. The more references, the more you gain from central maintenance — change the group once and every referencing site follows at the same moment.