CONTROL
Decide where people can sign in from.
Build policies like “Office only” or “Travelling staff”, each with its own IPs and ranges, and put people in them. Everyone else follows the default.
The CEO is always exempt, so you can’t lock yourself out.
IPv4 · IPv6 · CIDR
Overview
Office only, by default.
Set “Everyone else” to allow only your office addresses, in one switch.
Named exceptions.
Travelling sales staff can sign in from anywhere; remote engineers only through the VPN. Each person is in exactly one policy.
See what was blocked.
Recent blocked attempts show who, from which address, and under which policy.
HOW IT WORKS
Allow sign-in only from the office.
01
Open IP access.
Admin → IP access.
02
Lock down the default.
Edit Everyone else, choose Allow only from listed IPs, and press Add my IP.
03
Add an exception.
Add policy “Travelling staff”, Allow from anywhere.
FOR ADMINS
What admins control.
- Limits.
- Up to 50 policies, each with up to 100 IPv4 or IPv6 rules and labels.
- Enforced on your server.
- Checked against the real client address behind your reverse proxy.
- Audited.
- Every policy change and blocked sign-in is in the audit log.
- Always reachable.
- The CEO account is exempt from every policy.
Use cases
FINANCE
Office-only for the finance team.
Finance stays on “Everyone else”: only the Lisbon and Toronto office addresses.
SALES
Anywhere for people on the road.
Liam and Amara are in Travelling staff, so they can sign in from any address.
ENGINEERING
VPN-only for production access.
Jonas, Hana and Daniel are in Remote engineering: the Lisbon office or the VPN gateway.
Questions.
Something else? Talk to usWhat if I lock myself out?
The CEO account can always sign in, and the policy can be changed from there.
Does it work behind a proxy or load balancer?
Yes. Smack reads the trusted client address your reverse proxy passes on.
Can one person be in two policies?
No. Each person belongs to exactly one, which keeps the rules predictable.
Do IPv6 ranges work?
Yes, IPv4 and IPv6 addresses and CIDR ranges.
Does this apply to the desktop apps?
Yes. The check runs on the server for every sign-in.
OFFICE ONLY. EXCEPT WHEN NOT.
Docker Compose · Postgres · your S3 bucket · your domain