# IP filters in TCP, SSH, Postgres and Redis tunnels

June 13, 2025 · 3 min read

In the console client **tuna** version v0.25.0 we added the ability to restrict IPs and subnets from which connections can be made. This increases the level of security and is especially important in applications without built-in authorization.

## New flags

The `tuna tcp`, `tuna ssh`, `tuna postgres` and `tuna redis` commands have new flags and env analogs:

**Flags**

```shell
--cidr-allow # Reject connections that do not match specified CIDRs
--cidr-deny # Reject connections matching specified CIDRs

```

**Envs**

```shell
TUNA_CIDR_ALLOW # Reject connections that do not match specified CIDRs
TUNA_CIDR_DENY # Reject connections matching specified CIDRs

```

## Usage examples

**TCP**

You can define a whitelist of [subnets](https://en.wikipedia.org/wiki/Subnetwork) in CIDR format:

```shell
tuna tcp 3389 --cidr-allow="10.0.0.1/32"

```

Or block access from specific subnets:

```shell
tuna tcp 3389 --cidr-deny="10.0.0.1/32"

```

You can combine, for example specify a wide network and subtract private IPs:

```shell
tuna tcp 3389 --cidr-allow="10.0.0.1/24" --cidr-deny="10.0.0.33/32"

```

You can also pass lists separated by commas:

```shell
tuna tcp 3389 --cidr-allow="10.0.0.1/24,192.168.0.1/24" --cidr-deny="10.0.0.33/32,192.168.0.33/32"

```

**SSH**

You can define a whitelist of [subnets](https://en.wikipedia.org/wiki/Subnetwork) in CIDR format:

```shell
tuna ssh --cidr-allow="10.0.0.1/32"

```

Or block access from specific subnets:

```shell
tuna ssh --cidr-deny="10.0.0.1/32"

```

You can combine, for example specify a wide network and subtract private IPs:

```shell
tuna ssh --cidr-allow="10.0.0.1/24" --cidr-deny="10.0.0.33/32"

```

You can also pass lists separated by commas:

```shell
tuna ssh --cidr-allow="10.0.0.1/24,192.168.0.1/24" --cidr-deny="10.0.0.33/32,192.168.0.33/32"

```

**Postgres**

You can define a whitelist of [subnets](https://en.wikipedia.org/wiki/Subnetwork) in CIDR format:

```shell
tuna postgres 5432 --cidr-allow="10.0.0.1/32"

```

Or block access from specific subnets:

```shell
tuna postgres 5432 --cidr-deny="10.0.0.1/32"

```

You can combine, for example specify a wide network and subtract private IPs:

```shell
tuna postgres 5432 --cidr-allow="10.0.0.1/24" --cidr-deny="10.0.0.33/32"

```

You can also pass lists separated by commas:

```shell
tuna postgres 5432 --cidr-allow="10.0.0.1/24,192.168.0.1/24" --cidr-deny="10.0.0.33/32,192.168.0.33/32"

```

**Redis**

You can define a whitelist of [subnets](https://en.wikipedia.org/wiki/Subnetwork) in CIDR format:

```shell
tuna redis 6379 --cidr-allow="10.0.0.1/32"

```

Or block access from specific subnets:

```shell
tuna redis 6379 --cidr-deny="10.0.0.1/32"

```

You can combine, for example specify a wide network and subtract private IPs:

```shell
tuna redis 6379 --cidr-allow="10.0.0.1/24" --cidr-deny="10.0.0.33/32"

```

You can also pass lists separated by commas:

```shell
tuna redis 6379 --cidr-allow="10.0.0.1/24,192.168.0.1/24" --cidr-deny="10.0.0.33/32,192.168.0.33/32"

```

## IP policies in Team

In [teams](https://tuna.am/en/docs/team.md), if [IP policies](https://tuna.am/en/docs/team/ip_policies.md) are specified, they will work in conjunction with these flags.

## Update

To update, follow the [instructions](https://tuna.am/en/docs/guides/update.md).

## Leave feedback

If you enjoy using Tuna, or on the contrary you are not happy with something, please [leave feedback](https://my.tuna.am/?show_feedback=1).

![](/blog/img/2024-08-22/feedback.gif)

## News

We announce new features and posts on our [Telegram channel](https://t.me/tuna_am). Subscribe so you don't miss anything.

## Help

We value our users and carefully review every request. If you have any problems with tuna, please contact us in one of the following ways:

* [Email](mailto:info@tuna.am)
* [Telegram community](https://telegram.me/+Kgbtt0_gJwI5ZmEy)

**Tags:**

* [release](https://tuna.am/en/blog/tags/release)
* [tuna](https://tuna.am/en/blog/tags/tuna)
* [cli](https://tuna.am/en/blog/tags/cli)