Documentation Index
Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
Use this file to discover all available pages before exploring further.
Overview
The Security Center is an admin page that provides visibility into active connections, IP-based firewall controls, and an audit log of all connection activity across your organization’s workspaces. It has three tabs:- Overview - Summary of active sessions and recent firewall events
- Firewall - IP allowlist and denylist rules for controlling access
- Activity - Full log of connection sessions and firewall events
Accessing the Security Center
Overview Tab
The Overview tab provides a quick summary of the current security posture:- Active connection sessions - The number of currently open shell and preview connections across all workspaces.
- Recent firewall events - A summary of recent firewall activity, including blocked connection attempts.
Firewall Rules
The Firewall tab lets you define IP-based access rules that control who can connect to workspaces. Rules apply to both shell (terminal) connections and preview (HTTP) connections. Each firewall rule has the following fields:| Field | Description |
|---|---|
| Action | allow or deny - whether the rule permits or blocks the connection |
| CIDR Range | An IP address or CIDR block (e.g., 192.168.1.0/24 or 10.0.0.5) |
| Description | A human-readable label for the rule (e.g., “Office VPN” or “Block suspicious range”) |
| Priority | The position in the rule list - rules are evaluated top to bottom |
Creating a Rule
Add a New Rule
Click Add Rule. Fill in the action (
allow or deny), the CIDR range, and a description.Rule Evaluation Order
Rules are evaluated in order from top to bottom. The first rule that matches the connecting IP address wins - no further rules are checked. This means rule ordering matters. Consider the following example:| Priority | Action | CIDR | Description |
|---|---|---|---|
| 1 | Allow | 10.0.0.0/8 | Internal network |
| 2 | Deny | 10.0.5.0/24 | Restricted subnet |
| 3 | Deny | 0.0.0.0/0 | Block everything else |
10.0.5.15 would be allowed because it matches rule 1 first. The deny rule at priority 2 never executes for that IP. To block the restricted subnet, move the deny rule above the broader allow rule.
CIDR Notation
Rules accept standard CIDR notation:| Format | Meaning |
|---|---|
192.168.1.100 | A single IP address (equivalent to 192.168.1.100/32) |
192.168.1.0/24 | All IPs from 192.168.1.0 to 192.168.1.255 (256 addresses) |
10.0.0.0/8 | All IPs from 10.0.0.0 to 10.255.255.255 |
0.0.0.0/0 | All IPv4 addresses |
Default Behavior
When no firewall rules are configured, all connections are allowed. The firewall only activates when at least one rule is present.If you add rules, make sure your intended users are covered by an allow rule - or that they are not matched by any deny rule. Any IP that does not match any rule is allowed by default, even when other rules exist.
Reordering Rules
Because evaluation order determines which rule matches first, you can reorder rules by dragging them in the Firewall tab. After reordering, click Save to apply the new priority order.Example: Allow only office IPs
Example: Allow only office IPs
- Add a rule: Allow
203.0.113.0/24(your office network) - Add a rule: Deny
0.0.0.0/0(everything else) - Ensure the allow rule is above the deny rule
Example: Block a specific IP while allowing all others
Example: Block a specific IP while allowing all others
- Add a rule: Deny
198.51.100.42(the IP to block)
198.51.100.42 are blocked. All other IPs are allowed by the default policy.Example: Allow VPN and office, block everything else
Example: Allow VPN and office, block everything else
- Add a rule: Allow
10.8.0.0/16(VPN range) - Add a rule: Allow
203.0.113.0/24(office network) - Add a rule: Deny
0.0.0.0/0(block all other traffic)
Activity & Connection Audit
The Activity tab provides a full log of connection sessions and firewall events.Connection Sessions
Every time a user opens a terminal or accesses a preview, the session is recorded:| Field | Description |
|---|---|
| User Email | The authenticated email of the user who initiated the session |
| IP Address | The IP address the connection originated from |
| Connection Type | shell (terminal session) or preview (HTTP preview request) |
| Timestamp | When the connection was established |
| Status | Whether the connection is active or has ended |
Firewall Events
When a connection is blocked by a firewall rule, the event is logged separately:| Field | Description |
|---|---|
| IP Address | The IP that was blocked |
| Matched Rule | The specific firewall rule that caused the block |
| Timestamp | When the blocked connection attempt occurred |
| Connection Type | shell or preview |
How the Firewall Works
The firewall is enforced at two integration points: shell WebSocket connections and preview proxy HTTP requests.Shell Connections
When a user opens a terminal in a workspace:- The portal receives a shell connection request.
- Before establishing the WebSocket, the firewall evaluates the user’s IP address against the rule list.
- If a deny rule matches first, the connection is rejected and the terminal displays a
firewall_blockedmessage. - If an allow rule matches first, or no rules match (default allow), the connection proceeds normally.
- The connection attempt is logged in the Activity tab regardless of the outcome.
Preview Connections
When a user accesses the live preview panel:- The portal receives an HTTP request for the preview proxy.
- The firewall evaluates the user’s IP address against the rule list.
- If a deny rule matches first, the request is rejected.
- If an allow rule matches first, or no rules match, the request is proxied to the workspace container.
- The connection attempt is logged in the Activity tab.
Both allowed and blocked connections are recorded. This means the Activity tab provides a complete audit trail of all access to your organization’s workspaces, not just blocked attempts.
Next Steps
Security & Data Residency
Learn about the portal’s security architecture and data residency model.
Workspace Management
Monitor and manage all workspaces across your organization.
Access Control
Configure blueprint-level access rules by email or domain.