Security

What is Whitelist?

A whitelist is an explicit list of IP addresses, ranges or identities that a system allows, with everything else denied by default. Firewalls, admin panels, API gateways, database hosts and proxy providers all use them. On the proxy side, whitelisting your server's public IP lets it connect without sending a username and password.

Implementation is the same idea at every layer with different syntax. A cloud security group holds CIDR blocks, iptables matches a source address before the accept rule, nginx reads allow and deny lines in order, and a managed database exposes a network access list. Order decides behaviour, since the catch-all deny has to sit where the tool evaluates it last. Ranges are written in CIDR notation, so 203.0.113.4/32 is a single host while /24 covers 256 of them, a distinction people get wrong when pasting one address into a range field.

The address you register has to be the address the far end sees. A machine behind a NAT gateway or a load balancer leaves with the gateway's address rather than its own, and a dual-stack host may prefer IPv6 and arrive at an entry that only lists IPv4. Home connections change addresses whenever the ISP decides to. Query an echo service from the machine that will connect, not from your laptop, and register exactly what comes back.

An IP whitelist authenticates a network position and nothing more. Everyone sharing that egress point inherits the permission, which is comfortable on a dedicated server and much less so on an office NAT or a shared VPN exit. Source addresses can also be forged on paths where no return traffic is needed, so the control protects a TCP service considerably better than anything running over UDP. Treat it as one layer rather than the only door into the system.

Proxy providers use whitelists to skip credentials entirely. Register the IP of the box that will connect and it authenticates by arriving. Most cap how many entries an account can hold, and edits can take a short while to reach every gateway, so a home address that changes nightly turns this into constant maintenance. Automation servers with a stable address are where the method fits. A laptop on hotel wifi, or a box behind an ISP that reassigns on a whim, is better served by a username and password.

Where you meet it

You hit whitelisting from both directions. Your own infrastructure restricts who can reach it - an admin panel, a Redis instance, a payment API - and now your proxy egress has to be added, which means the target sees an address you control rather than a rotating one. In the other direction a proxy vendor asks for your server's IP so it can drop the password step. Check the IPv6 case before spending an hour debugging a refusal.

Common questions

What is the difference between a whitelist and a blacklist?

A whitelist denies everything by default and permits only listed entries, so an unknown address fails closed. A blacklist permits everything except what has been named, which is reactive and never complete. Whitelists are stronger where you can enumerate legitimate sources, and they break the moment a legitimate address changes without warning.

Can I whitelist a mobile proxy IP?

You can while it holds that address, but rotation makes the entry stale quickly and CGNAT means you would be authorising every other subscriber sharing the address at that moment. For access that has to keep working, either use a static exit the provider guarantees or switch that connection to credential-based authentication.

Why is my whitelisted IP still being denied?

Usually the far end sees a different address than the one you registered. Check the path for a NAT gateway or load balancer rewriting the source, and confirm whether the host prefers IPv6 or the CIDR mask you entered leaves the address out. Some systems also need a moment to propagate a new entry across their edge.

Related terms

Blacklist
A blacklist is a list of IP addresses, domains or ranges that a service refuses or restricts. Public DNS blacklists such as Spamhaus target mail abuse, while anti-bot vendors, CDNs and individual sites keep private ones. An address lands on a list after abuse reports, spam or automated traffic, and removal ranges from automatic expiry to a manual delisting request.
IP Authentication
IP authentication authorizes a proxy client by the source address of its connection instead of a credential. You register the public IP of the machine that will connect, and the provider's gateway accepts sessions from it while refusing the rest. There is no Proxy-Authorization header to send and no password sitting in a config file.
Anonymity
Anonymity, in proxy terms, is how much a destination server can learn about the client behind a connection. Proxy listings grade it by whether the proxy forwards your real IP or announces itself in request headers, though DNS, WebRTC and TLS details can give away the same information a header would.
Anonymous Proxy
An anonymous proxy hides the client's real IP address from the destination server but still identifies itself as a proxy, typically through a Via or Proxy-Connection header. The site learns that an intermediary is in the path and can act on that, without ever learning where the request originated.
Elite Proxy
An elite proxy, also called a high-anonymity or level 1 proxy, forwards requests without adding Via, X-Forwarded-For or any other header that reveals an intermediary. To the destination server the traffic reads as an ordinary direct connection from the proxy's own IP address. That address can still be classified.
Transparent Proxy
A transparent proxy intercepts traffic without any client configuration and passes the client's real IP to the destination, usually in an X-Forwarded-For header alongside Via. ISPs, schools and corporate networks deploy them for caching and content filtering. They give the user no privacy and are visible to any server that reads headers.
IP Reputation
IP reputation is the trust score a website, mail server or anti-bot system assigns to an IP address based on the traffic it has produced before. Spam complaints, request patterns, past abuse reports, hosting type and ASN ownership all feed that score. A poor one earns CAPTCHAs where a good one passes, or a refusal with no explanation.
Username Authentication
Username authentication identifies a proxy client with a username and password rather than by its IP address. HTTP proxies carry the credential in a Proxy-Authorization header, and SOCKS5 negotiates it during the handshake. Most providers also encode routing instructions - country, session identifier, rotation behaviour - inside the username string, so one endpoint can serve many configurations.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary