For developers
nsin edge IP ranges
nsin adds and retires edge servers as the network grows, so the addresses your origin sees change over time. Allow every prefix below on your origin firewall and edge traffic is never blocked — however the network shifts underneath it.
Use this script to whitelist new addresses in your server firewall automatically.
Last updated 2026-08-209 prefixes · 2,304 addresses
The list of nsin IPs is always available at this address
IPv4 prefixes
- 5.231.23.0/24
- 37.156.144.0/24
- 77.90.59.0/24
- 81.12.30.0/24
- 87.236.209.0/24
- 94.232.169.0/24
- 185.37.54.0/24
- 193.148.248.0/24
- 79.175.167.0/24
IPv6 prefixes
The nsin edge is IPv4-only today. IPv6 prefixes will appear here — and in ips.txt — before the first one carries traffic.
Before you lock the door
Allow first, restrict second
Add the prefixes and confirm your site still loads. Only then drop everything else on ports 80 and 443 — that is the step that stops an attacker from reaching your origin directly and walking around the edge.
Leave yourself a way in
SSH, your control panel, mail and every port nsin does not proxy still need to be reachable from your own networks. Locking a server to the edge alone has ruined more than one afternoon.
Re-check daily
New sites mean new prefixes, and a prefix can start serving the moment it is published. Fetch ips.txt at least once a day — or install the helper and let a timer do it.
Then trust the visitor header
Once only nsin can reach your origin, Nsn-Connecting-IP is safe to trust as the real visitor address. See the header reference.
Keep it in sync automatically
One install on the origin: it fetches the published list, allows every prefix in iptables, nftables, ufw, firewalld or CSF, and re-syncs on a timer — adding what is new and removing what nsin has retired.
View the repositorygit clone https://github.com/nsincloud/nsin-ipwhitelist.git
sudo ./nsin-ipwhitelist/install.sh