Network zones · BreezeAuth Docs

A network zone is a named list of IP address ranges that represents a network you trust, such as your office, your VPN, a data center or the servers that run one of your integrations. For example, a zone called “Headquarters” could contain the public addresses of your office internet connection.

Network zones don’t block anything on their own. They are building blocks: you create them once, and then use them in network access restrictions to say “only allow access from these networks”. The same zone can be reused in several places, and when you change a zone, every restriction that uses it is updated at once.

Where network zones are used

Restriction	Where to configure it	What it does
Organization network restriction	Organization › Security settings › Network access restriction settings	Every member of the organization, people and service users alike, can only access the organization from the selected zones. Managed users can also only sign in from them.
Application network restriction	Applications › an application › Overview › Security › Network access restriction settings	People can only sign in to that application through BreezeAuth (single sign-on) from the selected zones. Applies to managed and guest users.

More features will use network zones over time. When they do, their pages link back here.

IP addresses and CIDR blocks

Every device that connects to the internet does so through a public IP address, such as 203.0.113.25. When someone, or something, reaches BreezeAuth, BreezeAuth sees that address and can check whether it belongs to one of your zones.

Zones describe ranges of addresses using CIDR notation: an address followed by a slash and a number. The number says how many of the leading bits are fixed; the smaller it is, the larger the range.

CIDR block	Addresses included	Typical use
`203.0.113.25/32`	Exactly one address: `203.0.113.25`	An office with a single fixed IP, one server
`203.0.113.0/28`	16 addresses: `203.0.113.0` to `.15`	A small block of fixed IPs from your provider
`203.0.113.0/24`	256 addresses: `203.0.113.0` to `.255`	A larger office or data center range

A zone can contain several CIDR blocks, for example the addresses of two internet providers used by the same office. BreezeAuth currently supports IPv4 addresses.

Tip: use your public addresses, the ones the internet sees. Private addresses such as 192.168.x.x, 10.x.x.x or 172.16.x.x are only used inside your network and never reach BreezeAuth. If you are not sure which public addresses your office, VPN or servers use, ask your network or IT team, or your internet or cloud provider.

Create a network zone

In the sidebar, select Organization, then the Network Zones tab.
Select Add network zone.
Enter a Name that describes the network, for example “Headquarters” or “Billing integration servers”. Names must be unique in the organization.
In CIDR blocks, type each range and press Enter to add it.
Select Add.

To change a zone, select Edit next to it. Changes take effect immediately in every restriction that uses the zone, so double-check the addresses before saving.

To delete a zone, select Delete. A zone can only be deleted when it is not used by the organization’s or any application’s network access restriction; remove it from those settings first.

Restrict access to the organization

Create the network zones that should keep access, as described above.
In the sidebar, select Organization, then the Security settings tab.
Under Network access restriction settings, in Restrict access to authorized networks, select every zone that should be allowed.
Select Save changes, review the Confirm network access restriction dialog and confirm with I understand the risks.

Warning: the restriction applies to every member, including you, and takes effect as soon as you save. If you are not connecting from one of the selected zones, you will be locked out immediately. Make sure the list includes the networks of all administrators and of every service user’s servers before saving.

To lift the restriction, remove all zones from Restrict access to authorized networks and save.

Restrict access to an application

In the sidebar, select Applications and open the application.
On the Overview tab, select Security.
Under Network access restriction settings, in Restrict access to authorized networks, select the allowed zones.
Select Save changes and confirm with I understand the risks.

From then on, people can only sign in to the application through BreezeAuth from the selected zones. Sessions they already have open in the application itself are not interrupted.

Changes are audited

Creating, updating and deleting network zones, as well as adding or removing them from a restriction, are recorded in your organization’s Audit Logs.