IP Whitelisting - User Guide

IP Whitelisting lets you restrict your ThinkIQ system so that only connections from internet addresses you have approved are accepted. Everything else is turned away at the front door, before it reaches the application.

This is an additional layer on top of the user accounts, passwords and permissions you already use. It does not replace them: a valid username and password cannot be used from a network location you have not approved.

Until you add an entry, nothing is restricted. An empty list means "allow everyone", so switching the feature on changes nothing until you decide what to allow.

Your system has two separate entrances, each with its own independent list.

Two things people often do not realize:

• The web entrance covers more than browsers. Any script, reporting tool or partner system that uses the GraphQL or REST APIs comes through the same door and must be on the web list.
• The ingestion entrance is separate and easy to overlook. It is how your plant data arrives. Its list is managed independently, so a change made for office staff can never interrupt data collection, and vice versa.

Gather the addresses your organization uses. Your IT team or internet provider can confirm them.

• Your current address. The banner at the top shows the address you are connecting from and whether the web list covers it. Check it before you change the web list.
• Two tabs, Web and Ingestion, one per entrance. Each shows its entries with a label, an on/off switch, who added it and when, and who last changed it.
• Enforcement status. Under each tab's description a line reports what is actually in force: Enforcing 3 entries — last checked 09:41 UTC, or the list is empty, so all addresses are allowed. Immediately after you save it reads Changes pending — applied within about a minute, and switches back once the change is live. If it ever shows a warning, the change has not been applied; contact ThinkIQ support.

Click Add entry on the tab you want. One save can add one address or many:

IPv4 and IPv6 are both accepted. Give the entry a label such as "Manchester office" or "Site 4 gateway" so the list stays readable.

The page checks everything before saving:

• Invalid addresses are rejected and the form stays open for correction. When you paste a list, one bad element rejects the whole list and the message tells you which one, so nothing half-lands.
• Duplicates are refused, including a different spelling of a block that is already listed.
• Very broad blocks, and private or non-routable addresses that could never match internet traffic, are flagged for you to confirm before saving.
• If you type an address with host bits set inside a block, it is stored as the block and the page tells you.

• Edit changes an entry's address or label. An existing entry holds one address or block; to add more, add new entries.
• The switch turns an entry off without deleting it. Keep the Manchester office in the list but inactive, for example.
• Delete removes it after a confirmation.

Changes take effect within about a minute, with no downtime and no interruption to connections that are already established.

The web list will not let you lock yourself out by accident. If a change would leave the enabled web list not covering the address you are connecting from, the page stops and offers two ways forward:

• Add my current address and save, which adds your address as its own entry along with the change. This is the safe choice.
• Save without my address, for the rare case where you know better, for instance when you administer the system from an address that ThinkIQ support has already covered. You must type your current address to confirm.

The safeguard applies to every change on the web list: adding, editing, switching off and deleting. It never applies while the web list is empty, because an empty list blocks nobody.

The ingestion list has no lockout safeguard, because your browser's address says nothing about where your gateways are. The first entry you enable on the ingestion list starts blocking every gateway that is not listed, immediately.

So: gather every gateway address first, then add them all in one save using a comma-separated list. A gateway that is blocked keeps retrying and buffers data locally, so a short gap is recovered, but a forgotten site stays dark until it is added.

• Web: an "Access restricted" page in ThinkIQ style. It shows the visitor the address they connected from and tells them to ask their administrator to add it on the IP Whitelisting page, with a note that access is restored within about a minute of the change. That is exactly the information you need to resolve it.
• Ingestion: nothing visible. The gateway's connection is refused and it retries at increasing intervals. Its buffer drains once it is allowed.

1. Ask them for the address shown on the "Access restricted" page.
2. Add it on the web tab, or switch on the entry that should have covered it.
3. Access returns within about a minute; they can simply reload.

If the administrator is the one locked out, ThinkIQ support retains access at all times and can restore yours. Contact support with the address you are connecting from.

• Email and notifications are unaffected. They are sent out from the system and do not depend on the lists.
• Mobile and travelling staff should connect through your company VPN. Mobile networks change addresses too often to list reliably.
• Uptime monitors and integrations you rely on must be on the web list, or they will report your system as down.
• Everything is yours to adjust at any time. Adding a new office or site is a minute's work on the settings page, and switching an entry off is reversible.
• Change tracking. Every entry shows who added it and when, and who last modified it.