Access Restriction by IP

This module protects an Odoo instance by allowing each user to log in only from approved IP address ranges. Administrators add start and end addresses on the user record, every blocked attempt is logged, and an optional email alert can be sent when someone tries from an unauthorised address. It overrides the web login controller and extends the users model. It is used by system administrators and security officers. The benefit is a simple network-level guard on top of passwords.

1. 1

   Define allowed IP ranges per user

   In the user form the administrator opens the Allowed IPs tab and adds lines with a starting and ending IP address. Each line is checked for a valid format and a consistent range. A user with no lines is not restricted.

   • Tab: Allowed IPs
   • Start and end address
   • Format validation
2. 2

   Enforce the check at login

   The overridden login route compares the visitor's IP with the user's ranges after credentials are entered. If it falls outside, the login is refused with a message. Allowed logins proceed as usual.

   • Custom /web/login route
   • IP compared to ranges
   • Refusal message
3. 3

   Log unauthorised attempts

   Each blocked attempt writes a record with user, IP address and date and time. The Unauthorized Access Log menu shows them in list and form views. Filters and group by user, IP address or date help investigation.

   • Menu: Unauthorized Access Log
   • User, IP, attempt date
   • Filters and group by
4. 4

   Email alerts for blocked logins

   In the settings the administrator enables the unauthorised-notification option. The system then sends an email template to the user about the blocked login attempt. It can be turned off at any time.

   • Setting: unauthorized notification
   • Email template
   • Toggle on or off
5. 5

   Keep administrators from locking themselves out

   Constraints on the user groups keep the Settings and Access Rights groups consistent so the administrator role stays intact. A demo user is included for testing. Administrators review the log periodically.

   • Group consistency checks
   • Demo user for testing
   • Periodic log review

Back to version applications