GoTerm
Menu
Get started
All guides

Keys, people and security

Open only from your addresses

Choose the addresses your workspace opens from, such as your office and your VPN. Anyone elsewhere is turned away, and someone away from the office can let themselves in by email for a day.

Updated

On this page
  1. How the check works
  2. Turn it on
  3. Away from the office
  4. See and end passes
  5. If you’re locked out
  6. Good to know

How the check works

With the list on, GoTerm looks at the address every request comes from: signing in, the app, terminals, files, tunnels, web tabs and share links.

alwaysallowedemailrefusedSomeone opens GoTermbrowser, desktop or phoneGoTerm checksthe address ofevery requestYour office or VPNon the listAway from the officea link by email,for 24 hoursEveryone elserefused and logged
Someone opens GoTerm; GoTerm checks the address the request comes from; an address on the list goes on, someone elsewhere can be let in by an emailed link for 24 hours, and everyone else is refused and logged.
  • Each workspace has its own list. On a shared GoTerm server, yours changes nothing for anyone else.
  • Single addresses and ranges, IPv4 and IPv6: 203.0.113.9, 203.0.113.0/24, 2001:db8::/48.
  • On every paid plan: Personal, Teams and Business.

Turn it on

The organization’s owner and admins keep the list.

  1. Open Admin, then Security.
  2. Choose Add my current address, or Add address for your office’s or VPN’s range. Give it a label, and a last day if it’s for an event.
  3. Turn on Open only from these addresses.

Tip: If your network has IPv6 too, add both addresses: your device may use either. The page shows the address GoTerm sees you on.

Admin → Security: the address GoTerm sees, the two switches turned on, and three allowed addresses: an office range, its IPv6 range and a VPN address.Open the full-size picture

Away from the office

With Let people allow their own address by email on, a person with the right password can let themselves in from where they are, for one day.

1A sign-in from elsewhererefused, whateverthe password2A link by emailonly if thepassword was right3Opened on that devicethe same computer4In for 24 hoursthat person only
Someone signs in from an address that isn’t allowed and is refused; if the password was right, GoTerm emails a link; opened on the same device, it lets that person in from that address for 24 hours.
  • The refusal looks the same whether the password was right or wrong, so it gives nothing away.
  • The pass covers one person from one address (and the same computer’s other address, IPv4 or IPv6). Everyone else there is still refused.
  • A new device still has to be confirmed, as it always does.

See and end passes

  1. Open Admin, then Security, and look under Passes in use: who, from where, and until when.
  2. Choose End to end a pass now, or Add to the list to keep its address.
  3. To let only the list in, turn off Let people allow their own address by email. Passes in use end at once.

If you’re locked out

  • Connect from an address on the list, such as your office network or VPN, and change the list from there.
  • With the email pass on, sign in where you are, then open the emailed link on the same device.
  • Ask another admin who is on an allowed address to add yours.
  • Nobody can get in? Write to us. On a GoTerm server of your own, whoever runs it can turn the list off with one command.

Good to know

  • GoTerm won’t save a change that would lock you out: the address you’re on has to stay allowed.
  • Take an address off the list and anyone connected from it is disconnected within seconds. Their terminal sessions keep running.
  • Up to 50 addresses or ranges, each with a label and an optional last day.
  • Every change, every refused address and every pass is in the audit log, under Security.
  • Direct mode in the desktop app connects from your own computer, not through GoTerm, so the list doesn’t apply to it.

Didn’t find your answer?

Write to us, and an engineer who builds GoTerm will reply.

Ask an engineer