--- title: Using Subnet Filtering for Enhanced SSRF Protection description: Svix has added subnet filtering to its open-source webhook server to protect against server-side request forgery (SSRF) attacks. The feature blocks requests to... canonical: https://daily.dev/posts/using-subnet-filtering-for-enhanced-ssrf-protection-rqdtgkqj9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Using Subnet Filtering for Enhanced SSRF Protection | daily.dev og:description: Svix has added subnet filtering to its open-source webhook server to protect against server-side request forgery (SSRF) attacks. The feature blocks requests to... og:url: https://daily.dev/posts/using-subnet-filtering-for-enhanced-ssrf-protection-rqdtgkqj9 og:image: https://api.daily.dev/og/posts/rQdtgKqj9.png og:image:alt: Using Subnet Filtering for Enhanced SSRF Protection og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Using Subnet Filtering for Enhanced SSRF Protection **[Svix Blog](https://daily.dev/sources/svix)** · 4 min read · 0 upvotes · 0 comments ## Summary Svix has added subnet filtering to its open-source webhook server to protect against server-side request forgery (SSRF) attacks. The feature blocks requests to private IP addresses by default, but can be configured via the whitelist_subnets parameter (or SVIX_WHITELIST_SUBNETS env variable) to allow specific CIDR ranges when private endpoints are needed for testing or internal use. The post also outlines general defense-in-depth practices like network segmentation, firewall rules, and VLANs/VPCs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I configure which private IP ranges are allowed for webhook endpoints in Svix? Set the whitelist_subnets configuration parameter (or SVIX_WHITELIST_SUBNETS environment variable) to an array of addresses or subnets in CIDR notation, such as [127.0.0.1/32, 10.0.0.0/8]. This allows webhooks to be sent to any endpoint whose IP or resolved IP falls within those ranges, useful for testing or internal deployments. _Developers wiring up webhook infrastructure track security-hardening releases like this on daily.dev._ ### Does open-source Svix protect against SSRF attacks by default? Yes, SSRF protection is enabled out of the box in the open-source Svix server through subnet filtering, which blocks requests to private IP addresses. No additional configuration is required unless you need to whitelist specific internal IP ranges for testing or internal use, in which case you use the whitelist_subnets parameter. _Teams securing webhook delivery pipelines follow open-source security features like this on daily.dev._ ### How can I completely disable SSRF protection in Svix if I only use it internally? Set the whitelist_subnets configuration parameter to [0.0.0.0/0], which disables all restrictions on IP ranges Svix endpoints can resolve to, including internal addresses. This is not recommended unless the deployment is fully internal and the risks are understood, since it removes protection against server-side request forgery. _Engineers weighing security trade-offs in webhook configs keep track of guidance like this on daily.dev._ ## Similar posts on daily.dev - [Preventing SSRF in Laravel: Why Blocking Private IPs Fails](https://daily.dev/posts/preventing-ssrf-in-laravel-why-blocking-private-ips-fails-xpdzp3fxe) · FREEK.DEV · 0 upvotes · 0 comments - [HTTP Client SSRF Mitigation with InetAddressFilter in Spring Boot](https://daily.dev/posts/http-client-ssrf-mitigation-with-inetaddressfilter-in-spring-boot-eiy9td6fz) · Baeldung · 2 upvotes · 0 comments - [GitHub - scoville/req\_ssrf: SSRF protection for Req](https://daily.dev/posts/github---scoville-req-ssrf-ssrf-protection-for-req-4awzo12ju) · ElixirStatus · 0 upvotes · 0 comments - [How to Prevent SSRF Attacks in PHP: Nette Http 3.4.0 – Nette Blog](https://daily.dev/posts/how-to-prevent-ssrf-attacks-in-php-nette-http-3-4-0-nette-blog-vyqjazxxc) · Nette · 4 upvotes · 0 comments - [CVE-2026-48736: IpUtils::PRIVATE\_SUBNETS Omits IPv6 Transition Forms: SSRF Bypass in NoPrivateNetworkHttpClient \(Symfony Blog\)](https://daily.dev/posts/cve-2026-48736-iputils-private-subnets-omits-ipv6-transition-forms-ssrf-bypass-in-noprivatenetwor-h1uk3rm00) · Symfony · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/using-subnet-filtering-for-enhanced-ssrf-protection-rqdtgkqj9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Using Subnet Filtering for Enhanced SSRF Protection","url":"https://daily.dev/posts/using-subnet-filtering-for-enhanced-ssrf-protection-rqdtgkqj9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/using-subnet-filtering-for-enhanced-ssrf-protection-rqdtgkqj9"},"datePublished":"2026-08-23T07:20:42.624Z","dateModified":"2026-08-23T07:28:27.245Z","description":"Svix has added subnet filtering to its open-source webhook server to protect against server-side request forgery (SSRF) attacks. The feature blocks requests to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a4414d11729fa33413a6ff91740fb815?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a4414d11729fa33413a6ff91740fb815?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Svix Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Svix Blog","logo":"https://media.daily.dev/image/upload/s--Shf9MlOr--/f_auto,q_auto/v1787469609/logos/svix?_a=BAMAMicg0","url":"https://daily.dev/sources/svix"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/using-subnet-filtering-for-enhanced-ssrf-protection-rqdtgkqj9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,appsec","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Svix Blog","item":"https://daily.dev/sources/svix"},{"@type":"ListItem","position":3,"name":"Using Subnet Filtering for Enhanced SSRF Protection"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/using-subnet-filtering-for-enhanced-ssrf-protection-rqdtgkqj9#faq","mainEntity":[{"@type":"Question","name":"How do I configure which private IP ranges are allowed for webhook endpoints in Svix?","acceptedAnswer":{"@type":"Answer","text":"Set the whitelist_subnets configuration parameter (or SVIX_WHITELIST_SUBNETS environment variable) to an array of addresses or subnets in CIDR notation, such as [127.0.0.1/32, 10.0.0.0/8]. This allows webhooks to be sent to any endpoint whose IP or resolved IP falls within those ranges, useful for testing or internal deployments. Developers wiring up webhook infrastructure track security-hardening releases like this on daily.dev."}},{"@type":"Question","name":"Does open-source Svix protect against SSRF attacks by default?","acceptedAnswer":{"@type":"Answer","text":"Yes, SSRF protection is enabled out of the box in the open-source Svix server through subnet filtering, which blocks requests to private IP addresses. No additional configuration is required unless you need to whitelist specific internal IP ranges for testing or internal use, in which case you use the whitelist_subnets parameter. Teams securing webhook delivery pipelines follow open-source security features like this on daily.dev."}},{"@type":"Question","name":"How can I completely disable SSRF protection in Svix if I only use it internally?","acceptedAnswer":{"@type":"Answer","text":"Set the whitelist_subnets configuration parameter to [0.0.0.0/0], which disables all restrictions on IP ranges Svix endpoints can resolve to, including internal addresses. This is not recommended unless the deployment is fully internal and the risks are understood, since it removes protection against server-side request forgery. Engineers weighing security trade-offs in webhook configs keep track of guidance like this on daily.dev."}}]} ```