# How to whitelist dynamic host IP

**URL:** <https://community.traefik.io/t/how-to-whitelist-dynamic-host-ip/16091>\
**Category:** Traefik v2\
**Tags:** middleware\
**Created:** [October 11, 2022, 9:13am UTC](https://community.traefik.io/t/how-to-whitelist-dynamic-host-ip/16091 "2022-10-11T09:13:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fred](https://avatars.discourse-cdn.com/v4/letter/f/db5fbb/32.png) [@Fred](https://community.traefik.io/u/Fred)\
**Post date:** [October 11, 2022, 9:13am UTC](https://community.traefik.io/t/how-to-whitelist-dynamic-host-ip/16091/1 "2022-10-11T09:13:20Z")

</div>

The ipwhitelist middleware nicely provides access control via white-list IPs and IP ranges, but it does not access or handle hostnames.

I'd like to whitelist the IP, which a dyndns domain name points to, which is dynamically assigned by a provider, ie the IP `my.host.com` resolves to at the time traefik receives a request to my service.

Is there a way to achieve this?

Apache seems to do this like so:

```auto
<RequireAny>
  Require forward-dns my.host.com
  Require forward-dns my.otherhost.com
</RequireAny>

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [October 11, 2022, 7:11pm UTC](https://community.traefik.io/t/how-to-whitelist-dynamic-host-ip/16091/2 "2022-10-11T19:11:22Z")

</div>

[IPwhitelist](https://doc.traefik.io/traefik/middlewares/http/ipwhitelist/) middleware is configured via dynamic configuration. You can use a [provider.file](https://doc.traefik.io/traefik/providers/file/) in your static Traefik configuration to load it. This can be watched and automatically reloaded. With that enabled you can create a simple automatic script with `cron` to create and update your IP configuration.

---

<div class="post-metadata">

**Author:** ![Fred](https://avatars.discourse-cdn.com/v4/letter/f/db5fbb/32.png) [@Fred](https://community.traefik.io/u/Fred)\
**Post date:** [October 12, 2022, 12:19pm UTC](https://community.traefik.io/t/how-to-whitelist-dynamic-host-ip/16091/3 "2022-10-12T12:19:00Z")

</div>

Thanks for that contribution @bluepuma77, your work-around is working, two comments:

1. When updating the new dynamic config provider file, I was careful to do this in a way that will not change the inode of the existing file, as that could break traefik's watch mechanism:

```auto
      sed "s/$entry/$new_entry/" < $DYN_FILE > $TMP_FILE
      cat $TMP_FILE > $DYN_FILE

```

1. While the solution is quite neat, it still introduces a max delay of 5 mins (cron job interval) before an IP change becomes visible to traefik (on top of the duration taken to propagate the change to DNS servers). During this time users of the app will see a 404-page. If traefik were to perform the lookup when a page is requested, this delay disappears (at the cost of the lookup on every access). In my view this would be the 'correct' solution, as apache has implemented.

Something like allowing a `Host` entry (as used in router `rule`) in `ipwhitelist` would be nice:

```auto
- "traefik.http.middlewares.my-ipwhitelist.ipwhitelist.sourcerange=Host(`my.host.com`), 218.43.18.0/24"

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [October 12, 2022, 7:14pm UTC](https://community.traefik.io/t/how-to-whitelist-dynamic-host-ip/16091/4 "2022-10-12T19:14:15Z")

</div>

Cron can run every minute, alternatively you run your script continuously with a `sleep 10` seconds.

DNS is a beast because data is passed though a hierarchy and even though there is usually a TTL, not every DNS server in the chain will respect a very short time. So the response might be cached and old, despite the target IP already being a different one. Dyn-DNS is not for high availability.