You move a working application from your laptop to a VPS. The proxy hostname, port and code stay the same, but access stops working. If the endpoint uses IP authentication, check the address arriving at the proxy before changing the application.
The allowlist checks the incoming connection
The provider compares your connection's public source IP with an allowed list. This is the address of the machine or network reaching the proxy. The proxy's exit IP is a different address, used when it connects onward to the destination.
Consider an illustrative setup using documentation addresses:
| Client | Public source IP | On the allowlist? |
|---|---|---|
| Home computer | 198.51.100.24 | Yes |
| VPS | 203.0.113.17 | No |
The home request is accepted. The VPS request fails the source-IP check. Adding the proxy's exit IP would not correct this mismatch.
Check the route used by the application
- Confirm that the purchased endpoint is configured for IP authentication. Some products use a different endpoint or port for username/password access.
- Determine the public outbound address from the machine running the application, on the route used to reach the proxy. A lookup from your laptop cannot tell you the VPS address.
- Account for a NAT gateway, VPN, container host or other outbound gateway. The local interface address may be private, and a VPN may change the public source.
- Check the address family. An IPv4 allowlist entry does not authorize a separate IPv6 source address. Use the provider's supported method for the family involved.
- Compare the observed source with the provider's allowed entries. Update the relevant entry if authorized, allow for the provider's documented propagation time, and retry with a fresh connection.
An IP-checking request sent through the proxy normally reports the proxy exit. That is useful for checking the destination-facing address, but it does not identify the address the proxy saw on the incoming connection. Direct checks can also be misleading with destination-dependent routing. Provider connection logs or a controlled test on the actual route can help resolve that case.
Decide whether the address is stable enough
A home connection can receive a different public address after a reconnect. Cloud workloads may also share or change outbound gateways. Automatic allowlist updates are useful only if the provider supports them and the update process is reliable.
For frequently changing sources, username/password authentication may be easier to operate when the product supports it. That choice does not make the transport encrypted: protect the connection to the proxy separately.
Once the source-IP check passes, investigate later stages separately. A destination-side login page or access denial is not evidence that the proxy allowlist failed.
Source: ProxyData: IP Authentication. This adaptation was prepared with AI assistance.
Top comments (0)