VizionFirewall - IP filtering and access protection

Stay in control of access to your Dolibarr.

VizionFirewall lets you manage allowed and blocked IP addresses directly in Dolibarr, without changing your Apache or nginx configuration.

Combine your own rules with remote lists and automatic IP bans after repeated failed logins. Review the module’s decisions through a dashboard and an event log.

Your access rules, in a dedicated interface

• Allowlists and blocklists: allow trusted addresses and block individual IPs or network ranges. The allowlist takes priority when evaluating IP rules.
• Automatic IP bans: block an IP after repeated failed logins. Configure the threshold, counting window and ban duration; defaults are 5 failures in 10 minutes, with a one-hour ban.
• Simulation mode (Sandbox): observe the decisions that would be applied without blocking visitors. Check your rules before switching to production.
• Remote HTTPS lists: synchronize external sources through Dolibarr scheduled jobs. The Malicious IP “top 40,000” source is preconfigured; a download is attempted during installation, subject to availability. The entry count depends on the retrieved content.
• Optional geoblocking: allow or deny countries using GeoIP MaxMind and a compatible database.
• Dashboard and event log: review events and blocking reasons. The “Check an IP” tool shows how an address would be handled.
• Customizable access-denied message: edit the message shown to blocked visitors and preview it.

A gradual setup process

1. Deploy the module and enable VizionFirewall in Dolibarr. Filtering is initially off.
2. Grant the required permissions and add your trusted addresses to the allowlist.
3. If your installation uses a reverse proxy, configure the trusted proxies.
4. Enable Sandbox mode, then review the event log and check your rules.
5. Switch to Production after the prerequisite checks pass, including checks for the cache, administrator IP and proxy configuration.

Requirements and scope

• Dolibarr 22 minimum and PHP 8.1 minimum. Refer to the versions listed as compatible on this product page.
• An operational Dolibarr scheduled job and outbound HTTPS access are required for automatic remote-list synchronization.
• Geoblocking and geographic information require GeoIP MaxMind and a compatible MMDB database.
• Rules support IPv4, IPv6 and CIDR ranges. Reverse proxies must be configured in the module.

VizionFirewall provides application-level IP filtering at supported Dolibarr entry points: authentication, sessions, REST API calls, downloads and pages using the corresponding hooks. Static files served directly by the web server are outside its scope. It complements updates, strong authentication and server security.

In production, a request denied by the rules receives a 403 response. If filtering cannot be applied, for example when the cache remains unavailable or the proxy configuration is invalid, the module may return a 503 response. Simulation mode helps identify these situations before switching to production, without guaranteeing that later incidents cannot occur.

Remote lists come from third parties: their availability and content may change.

Configure your rules, observe their effects, then enable blocking from Dolibarr.

Developed and published by AREXYS (AREXYS SARL). Interface and help available in French, English, Spanish, Italian and German. Licensed under GPL-3.0-or-later.

Product page and information · Support contact