Security
Configure IP lists, country access, and rate limiting for your app.
Control which IPs and countries can reach your app and how many requests they can make. Rules apply at the edge, before traffic reaches your containers, and take effect within a few moments.
Plan Requirements
Advanced security options are available only on the Professional plan for Meteor apps or the Production plan for Web Apps.
Allow List
Exempts specific IP addresses and CIDR ranges from Custom DDoS rate limiting and Country Access restrictions. It does not restrict who can reach your app. Addresses that aren't listed can still connect, they're just subject to your rate limit and any country policy like everyone else.
Click +, then enter a single IP or a CIDR range. Add an optional description to track what each entry is for. Use it for trusted office, VPN, monitoring, or CI addresses that shouldn't get throttled.
Not an Access Restriction
The Allow List bypasses rate limiting and Country Access restrictions for listed addresses. It doesn't block anyone else from reaching your app. For country-based restrictions, use Country Access. For IP-specific blocking, use the Deny List.
Deny List
Blocks specific IPs while everyone else connects normally. Click +, enter an IP or CIDR range, and add an optional reason. The block stays until you remove it.
An IP can live on one list at a time, never both. If a conflict would occur, the Deny List wins. Galaxy prevents you from adding the same address to both.
Country Access
Country Access controls app access based on the visitor's country. It costs $200 per app per month. Turning it on starts a recurring charge, and turning it off credits unused time in the current billing period.
Choose an access policy, then search for and select one or more countries. Your country selections stay saved while Country Access is off. Active policies require at least one selected country.
Off: Don't restrict access by country.
Block selected countries: Visitors from selected countries receive a 403 response before reaching your app. Other countries remain allowed.
Allow only selected countries: Visitors from countries that aren't selected, including visitors whose country can't be determined, receive a 403 response before reaching your app.
Click Save changes to apply the policy. When you activate Country Access, review the price and confirm the recurring charge. A user with billing-management permission must accept the charge.
Allow List Addresses Bypass Country Restrictions
IP addresses on your app's Allow List continue to reach the app even when their country is restricted. Country Access is separate from the Allow List and Deny List settings.
Custom DDoS
Caps how many requests a single source IP can make in a rolling 30-second window. Enable rate limiting, then set your threshold. The default is 500 requests per IP per 30 seconds. IPs that exceed it receive a 429 Too Many Requests response until their rate drops back down.
Currently Blocked IPs: A live table of every IP currently over the limit, with its request count and how long Galaxy has tracked it. Promote any row to your Allow List (to exempt it) or Deny List (to block it permanently).
Throttle, Not Ban
Rate limiting is temporary. An IP that slows down is served again as soon as its rate recovers. For a permanent block, use the Deny List.