---
title: Manage IP filters in ECH or Serverless
description: Filtering network traffic, by IP address or CIDR block, is one of the security layers available in Elastic Cloud Enterprise and Elastic Cloud Hosted...
url: https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/security/ip-filtering-cloud
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Cloud Hosted: Generally available
---

# Manage IP filters in ECH or Serverless
Filtering network traffic, by IP address or CIDR block, is one of the security layers available in Elastic Cloud Enterprise and Elastic Cloud Hosted. It allows you to limit how your deployments can be accessed. IP filters are a type of [network security policy](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/security/network-security-policies).
There are types of filters are available for filtering by IP address or CIDR block:
- **Ingress or inbound IP filters**: These restrict access to your deployments from a set of IP addresses or CIDR blocks. These filters are available through the UI.
- **Egress or outbound IP filters**: These restrict the set of IP addresses or CIDR blocks accessible from your deployment. These might be used to restrict access to a certain region or service. This feature is currently only available through the [Traffic Filtering API](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/security/network-security-api). <applies-to>Elastic Cloud Hosted: Beta</applies-to> <applies-to>Elastic Cloud Serverless: Unavailable</applies-to>

Follow the step described here to set up ingress or inbound IP filters through the Elastic Cloud Console.
To learn how IP filters work together, and alongside [private connection policies](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/security/private-connectivity), refer to [Network security policies in Elastic Cloud](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/security/network-security-policies).
To learn how to manage IP filters using the Traffic Filtering API, refer to [Manage network security through the API](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/security/network-security-api).
<note>
  To learn how to create IP filters for Elastic Cloud Enterprise deployments, refer to [Manage IP filters in ECE](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/security/ip-filtering-ece).To learn how to create IP filters for self-managed clusters or Elastic Cloud on Kubernetes deployments, refer to [Manage IP filtering in ECK and self-managed clusters](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/security/ip-filtering-basic).
</note>


## Requirements

Serverless projects require the [Serverless Plus add-on](/elastic/docs-builder/docs/3016/deploy-manage/deploy/elastic-cloud/project-settings#serverless-plus) to apply IP filter policies. During the promotional period, applying an IP filter policy to a project opts that project in to Serverless Plus.
<tip>
  You can opt out by disconnecting all policies from the project.
</tip>


## Apply an IP filter to a deployment or project

To apply an IP filter to a deployment or project, you must first create an IP filter policy (referred to as "IP filter") at the organization or platform level, and then apply it to your deployment.

### Step 1: Create an IP filter

You can combine multiple IP address and CIDR block traffic sources into a single IP filter, so we recommend that you group sources according to what they allow, and make sure to label them accordingly. Because multiple IP filters can be applied to a deployment, you can be as granular in your IP filter policies as you require.
To create an IP filter:
1. Log in to [Elastic Cloud](https://cloud.elastic.co?page=docs&placement=docs-body).
2. From the navigation menu, select **Security** > **Network security**.

1. Select **Create policy** > **IP filter**.
2. Select the resource type that the IP filter will be applied to: either hosted deployments or serverless projects.
3. Select the cloud provider and region for the IP filter.
4. Add a meaningful name and description for the IP filter.
5. Under **Access control**, select whether the IP filter should be applied to ingress or egress traffic. Currently, only ingress traffic filters are supported.
6. Add one or more allowed sources using IPv4, or a range of addresses with CIDR.
7. Optional: Under **Apply to resources**, associate the new filter with one or more deployments or projects. After you associate the  IP filter with a deployment or project, it starts filtering traffic.
8. To automatically attach this IP filter to new deployments or projects, select **Apply to future resources by default**.
9. Click **Create**.


### Step 2: Associate an IP filter with a deployment or project

You can associate an IP filter with your deployment or project from the IP filter's settings, or from your deployment or project's settings. After you associate the IP filter with a deployment or project, it starts filtering traffic.
Serverless projects require the [Serverless Plus add-on](/elastic/docs-builder/docs/3016/deploy-manage/deploy/elastic-cloud/project-settings#serverless-plus) to apply IP filters. During the promotional period, applying an IP filter to a project opts that project in to Serverless Plus.
<tip>
  You can apply multiple policies to a single deployment or project. For Elastic Cloud Hosted deployments and Serverless projects, you can apply both IP filter policies and private connection policies. In case of multiple policies, traffic can match any associated policy to be forwarded to the resource. If none of the policies match, the request is rejected with `403 Forbidden`.[Learn more about how network security policies affect your deployment or project](https://www.elastic.co/elastic/docs-builder/docs/3016/deploy-manage/security/network-security-policies).
</tip>


#### From a deployment or project

<applies-switch>
  <applies-item title="serverless:" applies-to="Elastic Cloud Serverless: Generally available">
    1. Find your project on the home page or on the **Serverless projects** page, then select **Manage** to access its settings menus.
       On the **Serverless projects** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list.
    2. From the navigation menu, select **Network security**.
    3. Select **Apply policies** > **IP filter**.
    4. Choose the IP filter you want to apply and select **Apply**.
  </applies-item>

  <applies-item title="ess:" applies-to="Elastic Cloud Hosted: Generally available">
    1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus.
       On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list.
    2. From the navigation menu, select **Access and Security** > **Security**.
    3. Under **Network security**, select **Apply policies** > **IP filter**.
    4. Choose the IP filter you want to apply and select **Apply**.
  </applies-item>
</applies-switch>


#### From the IP filter settings

1. Log in to [Elastic Cloud](https://cloud.elastic.co?page=docs&placement=docs-body).
2. From the navigation menu, select **Security** > **Network security**.

1. Find the IP filter you want to edit and click the **Edit** `pencil` icon.
2. Under **Apply to resources**, associate the IP filter with one or more deployments or projects.
3. Save your changes.


## Remove an IP filter from your deployment or project

If you want to a specific IP filter from a deployment or project, or delete the IP filter, you’ll need to disconnect it from any associated deployments or projects first. You can do this from the IP filter's settings, or from your deployment or project's settings. To remove an association through the UI:

#### From your deployment or project

<applies-switch>
  <applies-item title="serverless:" applies-to="Elastic Cloud Serverless: Generally available">
    1. Find your project on the home page or on the **Serverless projects** page, then select **Manage** to access its settings menus.
       On the **Serverless projects** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list.
    2. From the navigation menu, select **Network security**.
    3. On the **Network security** page, find the IP filter that you want to disconnect.
    4. Under **Actions**, click the **Delete** icon.
  </applies-item>

  <applies-item title="ess:" applies-to="Elastic Cloud Hosted: Generally available">
    1. Find your deployment on the home page or on the **Hosted deployments** page, then select **Manage** to access its settings menus.
       On the **Hosted deployments** page you can narrow down your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list.
    2. From the navigation menu, select **Access and Security** > **Security**.
    3. Under **Network security**, find the IP filter that you want to disconnect.
    4. Under **Actions**, click the **Delete** icon.
  </applies-item>
</applies-switch>


#### From the IP filter settings

1. Log in to [Elastic Cloud](https://cloud.elastic.co?page=docs&placement=docs-body).
2. From the navigation menu, select **Security** > **Network security**.

1. Find the IP filter you want to edit, then click the **Edit** `pencil` icon.
2. Under **Apply to resources**, click the `x` beside the resource that you want to disconnect.
3. Click **Update** to save your changes.


## Edit an IP filter

You can edit an IP filter's name or description, change the allowed traffic sources, and change the associated resources, and more.
1. Log in to [Elastic Cloud](https://cloud.elastic.co?page=docs&placement=docs-body).
2. From the navigation menu, select **Security** > **Network security**.

1. Find the IP filter you want to edit, then click the **Edit** `pencil` icon.
2. Click **Update** to save your changes.

<tip>
  You can also edit IP filters from your deployment's **Security** page or your project's **Network security** page.
</tip>


## Delete an IP filter

If you need to remove an IP filter, you must first remove any associations with deployments.
To delete an IP filter:
1. Log in to [Elastic Cloud](https://cloud.elastic.co?page=docs&placement=docs-body).
2. From the navigation menu, select **Security** > **Network security**.

1. Find the IP filter you want to delete, then click the **Delete** `trash` icon. The icon is inactive if there are deployments or projects associated with the IP filter.