---
title: "IP Address Restriction and CDN Cache Control Policies"
description: "Restrict routes by client IP address and configure CDN caching separately from browser caching with two new Zuplo policies."
canonicalUrl: "https://zuplo.com/changelog/2026/09/22/ip-restrictions-cdn-cache-control"
pageType: "changelog"
date: "2026-09-22"
tags: "runtime, policy, security, performance"
---
Two new policies give you more control over who can call your API and how
responses are cached: **IP Address Restriction** and **CDN Cache Control**.

## Restrict routes by IP address

Limit a route to your office, VPN, or partner networks, or block specific
addresses and subnets. IP Address Restriction supports allow lists and deny
lists with individual IPv4 and IPv6 addresses or CIDR ranges.

Deny rules take precedence when an address matches both lists. Rejected requests
receive a `403 Forbidden`, and malformed entries are caught during deployment.
You can apply different lists to different routes and use environment variables
for each entry.

See the
[IP Address Restriction documentation](https://zuplo.com/docs/policies/ip-address-restriction-inbound)
for configuration examples.

## Control CDN and browser caching independently

Set a longer cache lifetime at your CDN while keeping browser caches short. CDN
Cache Control writes the appropriate response headers for Akamai, Fastly,
Cloudflare, CloudFront, or a CDN that supports the generic `CDN-Cache-Control`
header. CloudFront uses `s-maxage` in `Cache-Control` to set its separate CDN
lifetime.

For Akamai, Fastly, and Cloudflare, you can also add cache tags to group
responses for invalidation through your CDN's purge API. The policy validates
tags against each provider's limits. A custom function can set cache lifetimes
and tags per response.

By default, the policy respects upstream caching restrictions, including
`no-store`, `no-cache`, `private`, and `Set-Cookie` responses. Your CDN must be
configured to honor the headers the policy emits.

See the
[CDN Cache Control documentation](https://zuplo.com/docs/policies/cdn-cache-control-outbound)
for provider-specific setup and examples.

## Getting started

In the [Zuplo Portal](https://portal.zuplo.com), add IP Address Restriction to a
route's inbound policies or CDN Cache Control to its outbound policies, then
configure and deploy.