Public link access only from internal network

[Jan Velebny]

We would like to allow "Public links" for our colleagues (without access to Confluence) as "ready only"  and only with our company domain. 

Can this policy be set up somehow?

Thank you

Jan

[Kristian Klima]

Hello @Jan Velebny 

To allow your company users without Confluence seats to access confluence content, you can use one of the follownig apps.

• Scroll Viewport by K15t
• Instant Websites by Glintech

(To my best knowledge, only those two apps can help)

The app

a) creates a static website from you Confluence content

b) allows you to control access to that website with your SSO scheme.

At Emplifi, we're using Scroll Viewport to create a static website with the Internal version of the documentation and controll access with our SSO. You can determine who from your employees has access to such a site - all, specific roles, etc. 

[Marc - Devoteam]

HI @Jan Velebny 

No this is not possible, a created public link can be viewed by anyone on the internet if they have the link and as long as the link is active.

The content is always view only.

See, how-secure-are-public-links 

[Marc - Devoteam]

Hi @Jan Velebny as @Thiago P _Atlassian Support_ 

mentions,

Whitelisting can be an option, but it can be cumbersome if people need or want to access the pages outside the office.

[Thiago P _Atlassian Support_]

Hey there @Jan Velebny ,

As @Marc - Devoteam mentioned, Public Links are available to the whole Internet as long as they have the direct URL to the page (which is not indexed by search engines such as Google).

However, using Public Links in combination with IP Allowlist policies should work for you as access can be restricted to your Site for a specific list of IPs (or IP ranges using CIDR notation) used by your Company. Usually offices and VPNs have predefined outbound proxies that can be used for this.

Make sure to check our documentation: https://support.atlassian.com/security-and-access-policies/docs/specify-ip-addresses-for-product-access/

A few worthy notes:

• this feature is available in the Premium and Enterprise plans
• your company is responsible for coming up with a list of IPs and maintaining it

We have seen a number of Customers implement this strategy, either with Public Links or Anonymous Access.

Hope this helps!  =]

[Jan Velebny]

Hello Thiago,

thanks for your reply, very usefull.

In case we implement IP Allowlist policy, we will not affect our guest users outside of our organization? or users with we shared pages via "external share", will they have still access to contect where they had access before?

Thanks

Jan

[Thiago P _Atlassian Support_]

Hi @Jan Velebny , great question.

All users - including Guests - will be affected by IP Allowlist policies.

If you have Guests from outside your Organization, you'll need to include their source IP ranges as well.

If that's not a viable approach, then restricting Public Links to your company will not be possible.

[Jan Velebny]

Thank you Thiago,

so its mean that in case we implement IP Allowlist policy but we will not include our guest users, they will lost the access to Confluence?!

[Marc - Devoteam]

Hi @Jan Velebny 

Yes, they will lose access.

[Jan Velebny]

Sorry just, another question came to my mind with adding IP Allowlist policy, as we have many branches, is there any limit how many IP ranges can I add to the allowlist?

Thanks

Jan

[Thiago P _Atlassian Support_]

Hello @Jan Velebny ,

Yes, you can add up to 500 entries for each Product.

From the link I previously shared, under 'What values can you add?':

"You can set up 500 IP addresses or network blocks per app. We support IPv4 for individual IP address. If you're entering a network block, we support the CIDR notation standard for specifying a block of IP addresses. Refer to CIDR notation more details about how to use CIDR notation."

Hope this helps!  =]

[Jan Velebny]

yes, thank you I saw, but it is not clear if I set example range 101.112.10.1-254 will count as one entry or will count as 254?

[Thiago P _Atlassian Support_]

Oh I see, thanks for clarifying - ranges are counted as one entry only, so you can add multiple ranges (up to 500) regardless of the number of individual IPs they cover.