# Limiting access to channels/teams outside of company firewall

**URL:** <https://forum.mattermost.com/t/limiting-access-to-channels-teams-outside-of-company-firewall/8981>\
**Category:** Troubleshooting\
**Created:** [February 13, 2020, 8:31pm UTC](https://forum.mattermost.com/t/limiting-access-to-channels-teams-outside-of-company-firewall/8981 "2020-02-13T20:31:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vlee](https://avatars.discourse-cdn.com/v4/letter/v/96bed5/32.png) [@vlee](https://forum.mattermost.com/u/vlee)\
**Post date:** [February 13, 2020, 8:31pm UTC](https://forum.mattermost.com/t/limiting-access-to-channels-teams-outside-of-company-firewall/8981/1 "2020-02-13T20:31:50Z")

</div>

Hello,

Is there a way we can limit access to channels/teams outside company firewall.  
For example, we want guests to access on-prem mattermost channels but want to prevent on-prem from accessing certain mattermost channels from outside the office.

Thanks!

- Victoria

---

<div class="post-metadata">

**Author:** ![ahmaddanial](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/ahmaddanial/32/2938_2.png) [@ahmaddanial](https://forum.mattermost.com/u/ahmaddanial)\
**Post date:** [February 14, 2020, 12:13am UTC](https://forum.mattermost.com/t/limiting-access-to-channels-teams-outside-of-company-firewall/8981/2 "2020-02-14T00:13:54Z")

</div>

Hello, @vlee

With the usage of proxy, I believe that you should be able to (theoretically) block certain websites from being accessed from specific network. In this case, you want to blocking users from external IP address from accessing specific channels on Mattermost.

For example, using NGINX’s allow / deny - [Website access restriction using nginx](https://easyengine.io/tutorials/nginx/website-access-restriction-using-nginx/)

```auto
  location /<team_name>/channels/<channel_name> {
        allow <ip_address>;
        deny all;
    }

```

Is there any specific use case that you have on your end as to why the prevention of access needs to be applied?

---

<div class="post-metadata">

**Author:** ![ahmaddanial](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/ahmaddanial/32/2938_2.png) [@ahmaddanial](https://forum.mattermost.com/u/ahmaddanial)\
**Post date:** [February 14, 2020, 3:36am UTC](https://forum.mattermost.com/t/limiting-access-to-channels-teams-outside-of-company-firewall/8981/3 "2020-02-14T03:36:21Z")

</div>

@vlee Just got the confirmation that this approach won’t work. It would block loading a permalink to the app at such an address but not the app browsing from one channel to another, nor the various APIs that can be used programmatically based on @jesse’s feedback. At this point, I wonder if there is any other way to achieve this.