New: Control Access to Your Applications with Application Firewall

Attackers can exploit newly disclosed vulnerabilities in a matter of hours. That’s why securing your applications isn’t just about responding quickly when something goes wrong. It’s also about reducing their exposure in the first place.

This is especially important for internal tools and staging environments, which shouldn’t be accessible to anyone who doesn’t need access.

That’s where Application Firewall comes in. With this new feature, you can restrict access to your Scalingo applications by specifying which IPv4 addresses and ranges are allowed to connect.

Want early access? Contact our support team to enable it for your applications.

How It Works

Application Firewall lets you define up to 20 allowed IPv4 addresses or ranges per application.

• By default, with no rules configured, the firewall allows Internet traffic from all IP addresses. This is the current behavior.

• As soon as you add the first rule, only connections from the allowed IP addresses or ranges can access your application. All other requests receive an HTTP 403 response before reaching your application's containers.

Whether you use your Scalingo URL or a custom domain, the same rules apply and protect access to your application.

How to Configure Application Firewall

1. Log in to your Scalingo dashboard.

2. Select the application you want to protect.

3. Go to Settings, then Public Routing.

4. In the Firewall Rules section, allow up to 20 IPv4 addresses or ranges to access your application.
   
   

Application Firewall can also be configured through our API, CLI, and Terraform provider. For more technical details, check out our documentation.

Get Early Access

We're rolling out Application Firewall as an early-access feature for customers who request it.

To try it out, contact our support team directly from your Scalingo dashboard!

Use Cases

Restrict Access to Your VPN

You often ask us how to make an application accessible only to people connected to your organization's VPN.

With Application Firewall, you can allow only your VPN's public IPv4 addresses. As a result, only connections routed through your VPN can reach your application.

If your application also receives webhooks or is monitored by external services, remember to allow those services' IP addresses as well.

Restrict Access to Cloudflare

If you use Cloudflare in front of your application, you can allow only Cloudflare's proxy IPv4 ranges.

Direct connections from any other IP addresses will then be blocked, including requests targeting your application's Scalingo URL.

Go Further with a WAF and Private Networks

To inspect the content of HTTP requests as well, you can use a Web Application Firewall (WAF) such as ModSecurity on Scalingo.

For example, ModSecurity can detect and block SQL injection attempts in form parameters, even when the request comes from an IP address allowed by Application Firewall.

With Private Networks, you can expose only the proxy running ModSecurity to the Internet. This proxy then forwards accepted requests to your applications through your project's private network.

This way, Application Firewall controls which IP addresses can reach the proxy, while ModSecurity inspects and filters HTTP requests according to the rules you configure.