<p>Is there any way to restrict the access to the keycloak admin console by IP / IP Range? I have deployed the Keycloak in Azure Kubernetes that uses Nginx Ingress controller. So, I tried to restrict as highlighted below</p>
<p><a href="https://i.stack.imgur.com/4tFY5.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/4tFY5.png" alt="enter image description here" /></a></p>
<p>but it blocks everything. I would assume that Ingress receives the incoming request from the Azure Kubernetes Load balancer so it does not consider the client IP to allow access.</p>
<p>How do I restrict the access to the keycloak admin console by IP / IP Range?</p>
<p><strong>Update#1:</strong>
I believe that the above configuration to restrict the path by the IP / IP Range is effective expect that it redirects the coming request to a non-existing location</p>
<pre><code>xxx.xxx.xxx.xxx - - [30/Aug/2023:15:42:25 +0000] &quot;GET **/admin/** HTTP/2.0&quot; 404 548 &quot;-&quot; &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36&quot; 507 0.000 [-] [] - - - - bfbe1faa35dcc40e82e5e22bd557cf96

2023/08/30 15:42:25 [error] 1171#1171: *6809656 **&quot;/usr/local/nginx/html/admin/index.html&quot;** is not found (2: No such file or directory), client: 173.32.206.145, server: account.qa.oly.nova-x.co, request: &quot;GET /admin/ HTTP/2.0&quot;, host: &quot;xxxx&quot;
</code></pre>
<p>I was expecting this to apply just the IP based filter but not change the existing behaviour.</p>

One Developer
<p>You can use <code>loadBalancerSourceRanges</code> on the service as <a href="https://learn.microsoft.com/en-us/azure/aks/load-balancer-standard#restrict-inbound-traffic-to-specific-ip-ranges" rel="nofollow noreferrer">mentioned here</a>.</p>
<p>To restrict traffic for a certain path use <code>location-snippet</code> instead of <code>server-snippet</code> as detailed in <a href="https://stackoverflow.com/questions/73061277/nginx-ingress-controller-ip-restriction-for-certain-path">this answer</a>.</p>
