> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How do I restrict which IPs can reach my LoadBalancer Service?

> Allow specific client IP ranges to reach a public LoadBalancer Service on CKS.

Set `spec.loadBalancerSourceRanges` on a public `LoadBalancer` Service that you manage in CoreWeave Kubernetes Service (CKS). Specify the allowed client ranges in classless inter-domain routing (CIDR) notation. Keep the `service.beta.kubernetes.io/coreweave-load-balancer-type: public` annotation. Use `/32` to allow a single IPv4 address.

CKS silently drops traffic from external sources outside the allowed ranges. Blocked connection attempts time out instead of returning a connection-refused error. An omitted or empty list applies no source-IP restriction.

For the manifest and verification steps, see [Restrict access by source IP](https://docs.coreweave.com/products/networking/ingress-service/expose-service-dns.md#restrict-access-by-source-ip).

To restrict the cluster's direct public Kubernetes API endpoint, use `kubeApiAccess.public.allowCidrs` in the [Update Cluster API](https://docs.coreweave.com/products/cks/reference/cks-api/clusterservice/update-cluster.md#body-kube-api-access). This is a separate setting and doesn't filter the legacy public API ingress.

[Administrator](https://docs.coreweave.com/support/networking/tags/administrator.md)