Free tools Windows power users keep installed
One-click scans. No signup required.
Restrict access in layers: put self-hosted Jira and Confluence behind a firewall, private network, VPN, or reverse proxy; limit administration routes separately; and protect databases, storage, and cluster traffic at their own network boundaries. Product-level allowlists serve narrower purposes and do not replace controls on who can connect to the applications.
Choose the right boundary for each kind of traffic
For self-managed deployments, the infrastructure owner is responsible for securing the hardware, network, firewalls, and VPNs. Atlassian recommends allowing only the connections needed to operate and manage the deployment, and notes that it does not take responsibility for self-managed hardware infrastructure. See Atlassian’s Data Center security checklist and shared responsibilities.
As an Amazon Associate I earn from qualifying purchases.
First decide whether Jira and Confluence should be reachable only over private access, or whether users need public application access while administration remains restricted. Then map users, administrators, integrations, load balancers, cluster nodes, databases, and outbound features to the routes and connections they actually need. Avoid exposing backend application, database, or cluster ports to broad networks.
| Control | What it restricts | Where to enforce it |
|---|---|---|
| Firewall, private network, or VPN | Who can reach the application and supporting network services | Network perimeter or private access layer |
| Administration-path IP rules | Access to administration routes while preserving intended user routes | Reverse proxy or gateway |
| Confluence websudo allowlist | Who can use websudo-protected administrative operations | Confluence, using the client IP it receives |
| Jira URL allowlist | Which URLs Jira may accept or request for content and URL-based operations | Jira application configuration |
| Database, file, and cluster rules | Connections to supporting systems and between cluster nodes | Network and host-level controls |
How do I put Jira and Confluence behind a network boundary?
Allow inbound access only through intended entry points, such as a VPN or a reverse proxy, and limit backend connections to the components that need them. If a reverse proxy handles HTTPS, configure the proxy and the application’s matching Tomcat/proxy settings; Atlassian documents proxy and TLS patterns for Confluence in its Proxy and HTTPS setup for Confluence. Atlassian’s Confluence security best practices also cover administration, database, and connection controls.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
A web application firewall can add protection at the application edge, but it is an additional control—not a substitute for network access policy. Apply firewall and proxy rules in a way that preserves required user and integration traffic.
How do I restrict Jira and Confluence administration by IP?
Restrict administration routes at the proxy or gateway
At the reverse proxy or gateway, allow administration paths only from trusted networks or administrator IP addresses. Keep rules specific to the product, installed release, and proxy configuration, and preserve the routes required for normal use. Atlassian provides an Apache example for limiting Jira administration access in its Jira administration-interface guidance; its security guidance also discusses restricting administration routes. Confluence’s security practices provide an Apache restriction as a template for other reverse proxies.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Do not copy a proxy rule without checking the route list and behavior for your installed version and integrations. A rule that is too broad can block normal application features; one that is too narrow can leave an administrative route exposed.
Use Confluence websudo allowlisting as an additional control
The documented Confluence Data Center 8.9 websudo allowlist is disabled by default. It restricts access to websudo-protected operations by IP address or CIDR, but it is not a perimeter for all Confluence traffic. Before enabling it, configure the trusted proxy or gateway to forward the real client IP; the guide documents X-Forwarded-For as the default header. Ensure the gateway controls the forwarded value rather than trusting a header supplied directly by an untrusted client. Configure and verify the permitted addresses, retain a recovery path, then enable the allowlist and restart Confluence. Follow the version-matched websudo allowlist instructions.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What Jira’s URL allowlist does—and does not do
Jira’s URL allowlist controls URL-based content and requests, including incoming and outgoing URL behavior. It is not an ingress firewall: it does not determine which networks can connect to Jira’s web application. In the Jira Data Center 11.2 documentation, the allowlist is enabled by default; administrators choose its anonymous and outbound-request behavior, and Application Links are added automatically. Check the matching release’s Jira allowlist configuration before changing its policy.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How should I restrict Jira cluster and supporting-system access?
Permit Jira cluster traffic only between nodes
For Jira Data Center clusters, firewall or network-segmentation rules should permit required node-to-node traffic only between approved cluster nodes. Atlassian documents default Ehcache RMI listener and object ports 40001 and 40011; verify the ports configured in your deployment rather than assuming the defaults. Blocking required cache traffic can disrupt replication. See Atlassian’s Jira Data Center installation guidance.
Limit database and file access
Restrict database connections to the application hosts that need them, and limit access to Jira data directories and Confluence’s database. Atlassian’s guidance on security in the external environment addresses Jira database and filesystem restrictions; Confluence’s security best practices cover its database and connections.
Quick Recap
Implementation and verification sequence
- Map required connections. Record the sources and destinations for users, administrators, integrations, load balancers, cluster nodes, databases, and outbound features. Decide which application access is public and which must be private.
- Apply the network boundary. Put the applications behind the chosen firewall, private network, VPN, or proxy. Permit only intended entry points and required backend connections. If using a proxy, configure the product’s corresponding proxy and HTTPS settings.
- Restrict administration paths. Add source-IP rules at the proxy or gateway for the correct routes, and check that ordinary user and integration routes remain available.
- Configure product-level controls deliberately. If enabling Confluence websudo allowlisting, first validate trusted client-IP forwarding, the permitted addresses, and a recovery path. Keep Jira’s URL allowlist policy aligned with the URL-based operations the instance needs.
- Scope supporting traffic. Permit Jira cluster cache traffic only between cluster nodes, using actual configured ports; restrict databases and files to the application components that require access.
- Test each access path. Check from an allowed user workstation, an unapproved network, an administrator source, and required integration and cluster sources. Confirm expected user features work, administrative routes are blocked from untrusted sources, and integrations and cluster health remain functional.
- Recheck after changes. Review and retest rules after upgrades, migrations, topology changes, or proxy changes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
