Try it free

Allow IP ranges that can access your environment

  • Latest Dynatrace
  • How-to guide
  • 3-min read

Environment IP allowlisting restricts access to your Dynatrace environment to IP addresses that you consider acceptable. This covers access to the latest Dynatrace web UI and the API, which significantly limits a threat actor's ability to reach your environment directly.

This page is for Dynatrace and network administrators who need to limit external access to their Dynatrace environments to well-known and accepted CIDR ranges.

Prerequisites

  • The View and manage account and billing information (account-company-info) permission. For details, see Account Management permissions.
  • The CIDR ranges that you want to allow. Dynatrace supports IPv4 addresses. For details on the format, see CIDR notation.

Add a CIDR range to the allowlist

To add a CIDR range to the allowlist, you can use either Account Management or the API.

To add a CIDR range in Account Management:

  1. Go to Account Management > Settings > Environments.
  2. Select the row for the environment that you want to configure. The Environment ID pane opens to the right.
  3. In the IP allowlist tab, select Add CIDR range to add a new range.
  4. In the Add CIDR range pop-up, enter:
    • A human-readable name for the range, so that other administrators can recognize it.
    • The CIDR range. Account Management calculates the number of allowed IP addresses and lists the first and last usable IPs.
  5. If you want to add more ranges now, select CIDR Range and repeat step 4 for each range. Dynatrace supports up to 50 ranges.
  6. When you're done adding ranges, select Add to save your changes.

Dynatrace verifies your configuration to make sure that it doesn't affect Dynatrace IP addresses.

To add a CIDR range via API, see Environment management API - GET IP allowlist configuration and Environment management API - PUT IP allowlist configuration.

Blocked and allowed resources

If a user's IP isn't contained in the IP allowlist, they're blocked from accessing and using the latest Dynatrace web UI and API.

The IP allowlist doesn't block the following:

  • Access to the previous Dynatrace web UI and APIs (this includes all APIs on the *.live.dynatrace.com domain, including the ingest APIs)

  • Data ingest traffic of ActiveGates and OneAgents

  • Dynatrace IP addresses for support purposes

  • Outbound connections to allowlisted hosts in External requests for functions running in the Dynatrace JavaScript runtime. This includes functions run by Dynatrace Apps (for example, Workflow Connectors that need access to integrated resources) and custom JavaScript code you can run in Dashboards, Notebooks, or Workflows.

External requests enable outbound network connections from your Dynatrace environment to external services. They allow you to control access to public endpoints from the AppEngine with app functions and functions in Dashboards, Notebooks, and Automations.

  1. Go to Settings Settings > General > External requests.

  2. Select New host pattern.

  3. Add the domain names.

  4. Select Add.

This way you can granularly control the web services your functions can connect to.

CIDR notation

Dynatrace uses the IPv4 Classless Inter-Domain Routing (CIDR) system, as defined in RFC 4632, to specify which IP ranges can access your Dynatrace environment. This system pairs an IPv4 address with a subnet mask to define a range of allowed IP addresses.

For example, the CIDR notation 192.168.0.128/28 encompasses a block of 16 IP addresses, starting from 192.168.0.129 and ending at 192.168.0.142.

Related topics

  • Environment management API - GET IP allowlist configuration
  • Environment management API - PUT IP allowlist configuration
Related tags
Dynatrace Platform