What is IP Filtering?

IP Filtering is a VOS security capability that filters network traffic based on IP address reputation, geolocation, and administrator-defined allow and deny lists, enforcing an action – allow, alert, drop, reset, or a custom redirect – on any session whose source or destination address matches a configured condition.

Key takeaways

• IP Filtering blocks traffic by reputation, geolocation, and address lists.
• Predefined reputations cover botnets, phishing, scanners, and denial-of-service traffic.
• Actions range from allow and alert through drop, reset, and captive portal.
• Deny and allow lists override reputation- and geolocation-based decisions.
• It inspects both web and non-web traffic, at the network layer.

On this page: Why it matters · How it works · Types · IP Filtering & Versa · FAQ

Why is IP Filtering important?

Not every threat announces itself through a URL or a file. Botnet command-and-control servers, tor exit nodes, and known scanning infrastructure can be reached over any protocol, not just HTTP, so a security stack that only inspects web requests misses them entirely. IP Filtering closes that gap by evaluating the address itself – source and destination – against reputation and geolocation data, before any application-layer inspection even runs.

It also matters for cost and coverage together. Because it operates at the network layer on the IP tuple, IP Filtering adds minimal latency and applies uniformly to web and non-web traffic alike – FTP, SMTP, or any other protocol crossing the gateway. That makes it a natural baseline layer: cheap enough to apply to every rule, broad enough to catch malicious infrastructure that category- or content-based controls never see.

What is IP Filtering?

An IP-filtering profile evaluates a session’s source and/or destination address against several inputs: administrator-defined deny and allow lists, geolocation-based rules tied to a region, and reputation-based rules tied to a threat category such as botnets or phishing. Versa maintains a reputation feed updated daily and in real time; predefined regions cover geolocation without manual IP-to-country mapping.

Each input can enforce its own action – allow, alert, drop packet, drop session, or reject – with deny and allow lists taking precedence over reputation and geolocation results. Profiles attach to a security policy rule, so enforcement happens as part of normal access-control evaluation, not a separate pass. An optional address reverse-lookup can resolve the IP tuple to a domain and apply URL filtering on the result, useful for non-HTTP traffic where no URL is otherwise available.

Types of IP Filtering

Reputation-based filtering matches predefined threat categories – botnets, denial of service, phishing, proxy, scanners, spam sources, web attacks, and Windows exploits – sourced from a continuously updated feed. Geolocation-based filtering enforces actions by the request’s geographic region, useful for blocking traffic from countries with no legitimate business relationship. List-based filtering uses explicit administrator-maintained deny and allow lists for individual IP addresses or groups, overriding what reputation or geolocation would otherwise decide. Custom filtering lets administrators define their own actions – including captive portal pages, override PINs, or redirect URLs – instead of relying only on the predefined action set.

IP Filtering & Versa

On VOS devices, IP Filtering is configured through Director as profiles under Objects and Connectors, then applied to a next-generation firewall security policy rule. Versa ships several predefined profiles – including the Versa Recommended Profile, which enforces action across all nine reputation categories – plus a set of narrower presets like Block DoS and Block Scanners for teams that want a lighter baseline. A Prioritize URL Reputation setting can defer to URL filtering results for HTTP/HTTPS traffic, reducing false positives when an IP’s reputation is poor but the specific site is legitimate.

In SASE and NGFWaaS deployments, IP Filtering is recommended on every internet protection rule regardless of traffic type, precisely because it is the one control that inspects non-web protocols and adds negligible latency. Administrators monitor enforcement through Director’s Analytics view, which reports top IP-filtering actions and drills into matching flow logs. See Configure IP Filtering (NGFW) and Configure IP Filtering for the configuration procedures.

Frequently asked questions

What is the difference between IP Filtering and URL Filtering?

IP Filtering matches the source and destination IP address of any traffic, web or not, against reputation and geolocation data. URL Filtering inspects the HTTP/HTTPS request itself and matches the destination website’s category and reputation – a narrower but more granular control.

What action does IP Filtering take by default?

There is no single global default; each profile sets its own default action, applied when no deny list, allow list, geolocation rule, or reputation rule matches. Predefined profiles like the Versa Recommended Profile ship with reputation-based drop or alert actions already configured.

Can IP Filtering block traffic that isn’t HTTP or HTTPS?

Yes. Because it evaluates the IP tuple rather than application content, IP Filtering applies to any protocol – FTP, SMTP, DNS, or otherwise. Address reverse lookup can extend URL-based context to non-HTTP sessions by resolving the IP tuple to a domain first.

How current is the IP reputation data?

Versa Networks provides a reputation feed that updates both daily and in real time, covering categories like botnets, denial of service, phishing, scanners, and spam sources. Administrators can also look up any individual IP address’s current reputation and geographic location on demand, directly from Director.

Do allow lists override a bad IP reputation?

Yes. Deny and allow lists are evaluated ahead of reputation- and geolocation-based rules, so an explicitly allow-listed address is permitted even if it carries a poor reputation score, and an explicitly deny-listed address is blocked regardless of what its reputation or geolocation data says.

More on IP Filtering

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about IP Filtering, these are worth looking at next.