PHPackages                             skitlabs/ip-restriction-for-laravel - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. skitlabs/ip-restriction-for-laravel

ActiveLibrary

skitlabs/ip-restriction-for-laravel
===================================

Configurable IP allow/blocklist middleware for Laravel.

1.1.0(today)15↑2900%MITPHPPHP ^8.2

Since Aug 25Pushed todayCompare

[ Source](https://github.com/skitlabs/ip-restriction-for-laravel)[ Packagist](https://packagist.org/packages/skitlabs/ip-restriction-for-laravel)[ RSS](/packages/skitlabs-ip-restriction-for-laravel/feed)WikiDiscussions main Synced today

READMEChangelog (3)Dependencies (8)Versions (4)Used By (0)

IP Restriction Middleware for Laravel
=====================================

[](#ip-restriction-middleware-for-laravel)

Configurable IP allow-/blocklist (white-/blacklist) middleware package for Laravel 12 and 13.

Secure routes, groups, or the entire application using single IPs, CIDR ranges, or predefined configuration groups. Allows for per-route configuration overrides.

Features
--------

[](#features)

- **Allow- & Blocklist:** Using the provided `ip.allow` and `ip.block` middleware.
- **CIDR Support:** Supports IPv4 and IPv6 CIDR ranges (e.g., `10.0.0.0/8`, `2001:db8::/32`).
- **Named Groups:** Group IPs in your config file (e.g., `office`, `webhooks`) for clean and reusable lists.
- **Route-Level Overrides:** Override log level, channel, and config prefixes directly in your route definitions.
- **Stateless & Octane Ready:** Compatible with long-running processes that handle multiple requests, like Laravel Octane.

Requirements
------------

[](#requirements)

- PHP `^8.3`
- Laravel `^12.0` or `^13.0`

Installation
------------

[](#installation)

Install the package with composer:

```
composer require skitlabs/ip-restriction-for-laravel
```

Publish the configuration file:

```
php artisan vendor:publish --tag="ip-restriction-config"
```

This will create a `config/ip_restriction.php` file in your application.

Usage
-----

[](#usage)

The package automatically registers two middleware aliases:

- `ip.allow` (Allow only the configured IPs, blocking all other requests)
- `ip.block` (Block only the configured IPs, allowing all other requests)

Apply the middleware directly to your routes or route groups in `routes/web.php` or `routes/api.php`:

```
use Illuminate\Support\Facades\Route;

// Direct IP/CIDR configuration
Route::post('/api/internal', [Controller::class, 'handle'])
    ->middleware('ip.allow:192.168.1.50,10.0.0.0/16,::1');

// Mixed named groups and direct IPs
Route::get('/api/dashboard', [Controller::class, 'index'])
    ->middleware('ip.allow:office,203.0.113.20');

// Blacklisting bad actors
Route::post('/login', [Controller::class, 'attempt'])
    ->middleware('ip.block:known_bad_ips');
```

### Overrides

[](#overrides)

You can dynamically override middleware behavior per group or route. These overrides are resolved *before* evaluating other configuration. The *last* override wins.

#### Logging

[](#logging)

```
// Log ALL attempts to the 'security' log channel
Route::post('/webhooks/stripe', [Controller::class, 'handle'])
    ->middleware('ip.allow:webhooks,log:all,channel:security');

// Disable logging entirely
Route::get('/health-check', [Controller::class, 'index'])
    ->middleware('ip.allow:monitoring,log:none');
```

#### Config Prefix

[](#config-prefix)

By using the `config:`-prefix, you can override the base configuration key. This can be useful when managing multiple domains (e.g., Admin Panel and API) that require different defaults.
The following example would read configuration from `config/api_restrictions.php` instead.

```
Route::middleware(['ip.allow:config:api_restrictions,office'])->group(function () {
    // Middleware now uses `config/api_restrictions.php` to determine its defaults
});
```

### Global Middleware Registration

[](#global-middleware-registration)

You can register the middleware globally, or configure it manually using the static `configure()`-method, in your bootstrap/app.php file.

```
use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Middleware;
use Skitlabs\IpRestriction\Http\Middleware\AllowIpAddress;

return Application::configure(basePath: dirname(__DIR__))
    ->withMiddleware(function (Middleware $middleware) {
        // Append globally with dynamic configuration
        $middleware->append(
            AllowIpAddress::configure(
                allowed: ['office', '10.0.0.0/8'],
                logLevel: 'all',
                logChannel: 'security'
            )
        );
    })->create();
```

### Inline Middleware Configuration

[](#inline-middleware-configuration)

Use the middleware's static `configure`-method, and pass an instance directly to your routes/groups.

```
use Skitlabs\IpRestriction\Http\Middleware\AllowIpAddresses;

Route::get('/admin', [Controller::class, 'index'])
    ->middleware(AllowIpAddresses::configure(
        allowed: ['office', '127.0.0.1'],
        logLevel: 'all',
    ));
```

Configuration
-------------

[](#configuration)

The published `config/ip_restriction.php` allows control over how the middleware behaves:

```
return [
    // Toggle the middleware globally
    'enabled' => env('IP_RESTRICTION_ENABLED', true),

    // Environments where the middleware will quietly pass (e.g., local development)
    'ignored_environments' => ['local', 'testing'],

    // Define reusable groups of IPs
    'groups' => [
        'office'   => ['192.168.1.0/24'],
        'webhooks' => ['198.51.100.14', '2001:0db8:85a3::/64'],
        'public'   => ['0.0.0.0/0', '::/0'],
        // Passing lists as strings is supported. Extra spaces or trailing commas are trimmed
        'dynamic'  => env('ALLOWED_IPS', '192.168.1.50,  10.0.0.0/8, '),
    ],

    // Configure the level and channel to log to
    'logging' => [
        'level'   => env('IP_RESTRICTION_LOG_LEVEL', 'denied'),
        'channel' => env('IP_RESTRICTION_LOG_CHANNEL', 'default'),
    ],

    // Configure the returned response, for when access has been denied
    'response' => [
        'code'    => 403,
        'message' => 'Access denied (IP)',
    ],

    // Specify custom header if behind a non-configured TrustedProxy (e.g., 'HTTP_CF_CONNECTING_IP')
    'custom_header' => null,
];
```

Testing
-------

[](#testing)

```
composer test
```

License
-------

[](#license)

The MIT License (MIT). Please see [License File](LICENSE) for more information.

###  Health Score

42

—

FairBetter than 88% of packages

Maintenance100

Actively maintained with recent releases

Popularity7

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity48

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

3

Last Release

0d ago

PHP version history (2 changes)1.0.0PHP ^8.3

1.0.1PHP ^8.2

### Community

Maintainers

![](https://www.gravatar.com/avatar/042ca4096b736ba489b85363b2cfe48387f2d74535126fe9ea6ac89c7563b224?d=identicon)[skitlabs](/maintainers/skitlabs)

---

Top Contributors

[![jvriezinga](https://avatars.githubusercontent.com/u/1942353?v=4)](https://github.com/jvriezinga "jvriezinga (4 commits)")

---

Tags

middlewareIPblacklistcidrwhitelistblocklistallowlist

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StyleLaravel Pint

Type Coverage Yes

### Embed Badge

![Health badge](/badges/skitlabs-ip-restriction-for-laravel/health.svg)

```
[![Health](https://phpackages.com/badges/skitlabs-ip-restriction-for-laravel/health.svg)](https://phpackages.com/packages/skitlabs-ip-restriction-for-laravel)
```

###  Alternatives

[psalm/plugin-laravel

Psalm plugin for Laravel

3345.4M354](/packages/psalm-plugin-laravel)[laravel/mcp

Rapidly build MCP servers for your Laravel applications.

80427.1M249](/packages/laravel-mcp)[api-platform/laravel

API Platform support for Laravel

58190.1k21](/packages/api-platform-laravel)[illuminate/routing

The Illuminate Routing package.

1239.4M3.7k](/packages/illuminate-routing)[intervention/image-laravel

Laravel Integration of Intervention Image

1599.8M227](/packages/intervention-image-laravel)[spatie/laravel-export

Create a static site bundle from a Laravel app

679153.2k7](/packages/spatie-laravel-export)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)