Programming Jabber

The <allow/> and <deny/> Tags

You can control at the IP address and network level who can connect to your Jabber server with the <allow/> and <deny/> tags.

The default (when no tags are specified) is to allow connections from everywhere. If you use <allow/> tags, then connections will be allowed only from the addresses or networks specified. If you use <deny/> tags, then connections will be denied from those addresses or networks specified. If you have both <allow/> and <deny/> tags, the intersection of addresses between the two tag sets will be denied. In other words, <deny/> overrides <allow/>.

The tags wrap individual IP addresses, which are specified using the <ip/> tag, or network addresses, which are specified using the <ip/> tag in combination with the <mask/> netmask tag. Example 4-22 shows connections to a Jabber server being limited to hosts from two internal networks with the exception of one particular IP address, and a specific host on the Internet.

Example 4-22. Using <allow/> and <deny/> to control connections

<allow>
  <ip>192.168.10.0</ip>
  <mask>255.255.255.0</mask>
</allow>

<allow>
  <ip>192.168.11.0</ip>
  <mask>255.255.255.0</mask>
</allow>

<allow>
  <ip>195.82.105.244</ip>
</allow>

<deny>
  <ip>192.168.11.131</ip>
</deny>