# Manually routing event doesn't respect IP Address whitelisting

**URL:** <https://discuss.blues.com/t/manually-routing-event-doesnt-respect-ip-address-whitelisting/2195>\
**Category:** Notehub.io\
**Tags:** security\
**Created:** [June 28, 2024, 3:26am UTC](https://discuss.blues.com/t/manually-routing-event-doesnt-respect-ip-address-whitelisting/2195 "2024-06-28T03:26:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Meo](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.blues.com/meo/32/1183_2.png) [@Meo](https://discuss.blues.com/u/Meo)\
**Post date:** [June 28, 2024, 3:26am UTC](https://discuss.blues.com/t/manually-routing-event-doesnt-respect-ip-address-whitelisting/2195/1 "2024-06-28T03:26:27Z")

</div>

Hi!

I implemented IP whitelisting for my server’s webhook endpoint. The notehub documentation states that whitelisting 216.245.146.0/26 should be sufficient. I find that this is sufficient when events are routed automatically.

However, in the Notehub Web UI, there is a button “Route Event” which allows me to manually route an event which fired previously.

When I click this, I find my request gets rejected by my IP whitelisting rules.

 ![image](https://us1.discourse-cdn.com/flex020/uploads/blues/original/2X/8/8591c2cec8d16f1d7903414d43fa4e7b8aadf22b.png)

It’s not a big deal, but I thought this might’ve been an oversight. At a minimum, it would be good to call out this edge case in the docs.

Thanks!

---

<div class="post-metadata">

**Author:** ![jcsalem](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@jcsalem](https://discuss.blues.com/u/jcsalem)\
**Post date:** [June 28, 2024, 1:10pm UTC](https://discuss.blues.com/t/manually-routing-event-doesnt-respect-ip-address-whitelisting/2195/2 "2024-06-28T13:10:44Z")

</div>

Thank you for reporting this. This is a gap that we will correct in a future update.

You are correct that this only impacts events that are routed manually.