I just released IP Ban Manager v1.0.0, a HACS custom integration for managing Home Assistant’s built-in IP banning system from the UI.
Repository and install instructions:
This builds on palfrey’s original ban_allowlist integration. Big thanks to palfrey for the original allowlist work that made this possible. This new version expands that idea into a full management UI for allowlisted networks, active bans, automatic ban settings, services, sensors, and safer live editing.
Important: this is still a HACK. Home Assistant does not currently expose a public integration API for every part of the HTTP IP ban manager, so this integration uses a small internal hook around Home Assistant’s native ban manager. It keeps Home Assistant’s own ip_bans.yaml and live ban manager in charge.
What it does
Manage allowed IPs/networks from the UI
View and edit active banned IPs from the UI
Remove bans without restarting Home Assistant
Clear all bans from the UI
Enable/disable automatic bans from the integration options
Adjust the login attempt threshold from the integration options
Preserve Home Assistant’s normal ip_bans.yaml format
Show ban timestamps in a readable format
Add links to IP Ban Manager from Home Assistant ban/login notifications
Includes diagnostic sensors and services for automations/scripts
Supports CIDR and IPv4 wildcard shorthand like 192.168.1.* for allowlists
Home Assistant’s built-in IP banning is useful, but managing bans manually through ip_bans.yaml is clunky, especially when you need to remove an IP quickly without restarting. This integration gives that workflow a proper UI while still using Home Assistant’s native ban file and ban manager underneath.
This is the first version I would call the public-ready expanded release. It now goes beyond exact IP bans and allowlists by adding managed network blocking, better notification handling, cleaner branding, and the final move to the new ip_ban_manager integration domain.
Repository and install instructions:
What’s new
Add managed Blocked networks from the UI
Block CIDR ranges like 192.168.1.0/24
Block IPv4 wildcard ranges like 192.168.1.*
Keep allowlisted IPs/networks trusted even if they fall inside a blocked network
Manage Home Assistant exact IP bans from the UI without restarting
Enable/disable automatic bans from setup or Configure
Enable/disable automatic ban/login notifications
Adjust the login attempt threshold from the UI
Improved IP Ban Manager notifications with a local icon header and direct settings link
Diagnostic sensors for active bans, allowlisted networks, blocked networks, and failed-login sources
Full migration to the new ip_ban_manager domain and ip_ban_manager.* services
Existing installs from the old domain should migrate automatically on restart
Minimum Home Assistant version is now documented as 2024.7.4+
Important: this is still a HACK. Home Assistant does not currently expose a public integration API for every part of the HTTP IP ban manager, so this integration uses a small internal hook around Home Assistant’s native ban manager. Exact IP bans still stay in Home Assistant’s own ip_bans.yaml workflow.
Why this update matters
Home Assistant’s native IP banning only works with exact IP bans. IP Ban Manager now keeps that native exact-ban system in place, but adds a managed layer for blocking networks and wildcard ranges from the same Configure screen.
That means you can still remove a normal banned IP quickly, but you can also block a whole problem subnet while keeping trusted local or remote addresses allowlisted.
Thanks again to palfrey for the original allowlist integration this grew from.
Thanks for catching this. That was a packaging issue on my side.
HACS was seeing the old migration folder instead of the real IP Ban Manager integration, which is why Home Assistant showed “This integration cannot be added from the UI.”
I just released v1.2.1 to fix it:
Please update through HACS, restart Home Assistant, then add IP Ban Manager from the UI again.
If you still have the old ban_allowlist: YAML, IP Ban Manager will absorb that allowlist on first load. After it imports, you can remove the old ban_allowlist: key and restart if you want but it's not required.
Hi.
I'm testing IP Ban and it seems to do it's job. Great! As I understand it I have to block each individual subnet to only allow certain subnets? Ie there is no "block all" function?
When adding subnets to the block list the GUI is a bit off. I have to scroll a small area to view the subnet list.
Hi. I’m using v1.5.0 and trying to block all networks not on the allow list. I get this message “That would block a detected local Home Assistant network without a matching allowed entry”
I have allowed 192.168.0.0/16, 10.0.0.0/8 and 172.0.0.0/8.
How can I see what IP is used by HA, but not on my allowed list?
The “block all except allowed” workflow is now handled by the Block everything outside Allowed IPs option, so you should not need to manually add every blocked subnet.
The error you hit in v1.5.0 was from the safety check being too strict and giving a misleading message. Your allowlist ranges were valid, but IP Ban Manager could still reject default-deny if Home Assistant reported another adapter path that was not also visibly covered by Allowed IPs.
v1.5.4 is out now and should handle that better. Home Assistant’s own addresses are protected internally, default-deny no longer requires every detected adapter subnet to be listed in Allowed IPs, and the safety message is clearer if there is a real local access risk.
Please update to v1.5.4, refresh HACS repository information if needed, and let me know if that setup still gives you trouble.
