How to Enable IP-Based 2FA Restriction in Drupal

Overview

The IP-Based Restriction feature allows administrators to control how Two-Factor Authentication (2FA) is applied based on the user's IP address. Using this feature, administrators can define trusted IP addresses or IP ranges from which users can log in without being prompted for 2FA. If a user logs in from an IP address that is not included in the trusted list, the system will require them to complete Two-Factor Authentication for additional security. The Drupal Two Factor Authentication - 2FA / Passwordless Login is available for Drupal 8, Drupal 9, Drupal 10, and Drupal 11.

Download Pricing Plans Schedule a Meeting

Installation Steps

Post-Installation Prerequisites:

• Before configuring IP-based restriction, ensure that:
  • You have Administrator access to configure 2FA policies.
  • You know the trusted IP addresses or IP ranges that should bypass 2FA.

Configuration Steps

Open 2FA Policy Settings

• Log in to your Drupal site as an Administrator.
• Navigate to the 2FA Policy for End Users tab.
• Scroll down to the 2FA Restrictions section.
• From the left menu, select IP-Based Restriction.

Enable Trusted IP-Based 2FA

• Enable the Enable Trusted IP-Based 2FA toggle.
• Once enabled, the system will evaluate the user’s login IP address against the configured trusted IP list.
• In the input field, enter the trusted IP addresses or IP ranges that should bypass the 2FA prompt.
• Multiple IP addresses must be separated using a semicolon ( ; ).
• IP ranges should follow the format: lower_range - upper_range.
• Example: 192.168.1.10;192.168.1.20;192.168.1.1 - 192.168.1.50
• In this case:
• Users logging in from the above IP addresses or range will not be prompted for 2FA.
• Users logging in from any other IP address will be required to complete Two-Factor Authentication.
• Click the Save Settings button.
• A confirmation message will appear at the top of the page indicating the settings have been saved successfully.

You have successfully configured IP Based Restriction.

User Experience:

• Open a new browser/private window and navigate to your Drupal site login or registration page.
• Enter your email address and password.
• The system validates the email domain against the list of allowed domains configured by the administrator.
• If a user logs in from an IP address that is configured in the IP-Based Restriction settings, 2FA will not be invoked for that user since the IP address is considered a trusted IP.
• If the user’s IP address is not present in the configured IP list and IP-Based Restriction is enabled, the user will be prompted to set up 2FA if it has not been configured yet. If already configured, the user will need to authenticate using the configured 2FA method.