IP Whitelisting for Odoo: Restricting Access to Your Instance

# Define allowed IPs
geo $access_restriction {
    default 0;
    192.168.1.0/24 1;      # Office network
    203.0.113.50 1;        # Manager home IP
    198.51.100.0/24 1;     # VPN network
    2001:db8::/32 1;       # IPv6 office
}

server {
    listen 80;
    server_name odoo.example.com;
    
    # Block if not in whitelist
    if ($access_restriction = 0) {
        return 403 "Access denied. Please contact IT.";
    }
    
    # Proxy to Odoo
    location / {
        proxy_pass http://127.0.0.1:8069;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

pip install odoo-addon-user-login-restriction-by-ip

Admin User:
├── 192.168.1.10 (office desktop)
├── 192.168.1.20 (office laptop)
└── 198.51.100.5 (home VPN)

Sales Rep:
├── 192.168.1.0/24 (office network)
├── 203.0.113.50 (home IP)
└── 198.51.100.0/24 (mobile VPN)

Customer Portal User:
└── (no restriction - can log in from anywhere)

# Office main office IP (call ISP or IT)
# Example: 203.0.113.0/24

# Office secondary location IP
# Example: 198.51.100.0/24

# For remote workers
# Install: WireGuard or OpenVPN

# Remote staff connects to VPN
# VPN assigns IP from: 10.0.0.0/24

# Only VPN IPs can access Odoo

# Office networks + VPN
geo $access_allowed {
    default 0;
    203.0.113.0/24 1;      # Office main
    198.51.100.0/24 1;     # Office secondary
    10.0.0.0/24 1;         # Company VPN
}

server {
    listen 443 ssl http2;
    server_name odoo.example.com;
    
    # Allow office + VPN, block others
    if ($access_allowed = 0) {
        return 403 "Odoo access restricted to office network and authorized VPN.";
    }
    
    # Proxy to Odoo
    location / {
        proxy_pass http://127.0.0.1:8069;
        ...
    }
    
    # Customer portal can be accessed from anywhere
    location ~ ^/web/login {
        # No IP restriction for login (customers log in from home)
        proxy_pass http://127.0.0.1:8069;
        ...
    }
}

# Track all login attempts with IPs
class LoginAudit(models.Model):
    _name = 'login.audit'
    
    user_id = fields.Many2one('res.users')
    ip_address = fields.Char()
    timestamp = fields.Datetime(auto_now_add=True)
    success = fields.Boolean()
    reason = fields.Char()  # "IP not whitelisted", "Invalid password", etc

# Alert on suspicious attempts
@api.model
def log_login_attempt(self, user, ip, success, reason=''):
    """Log all login attempts."""
    self.env['login.audit'].create({
        'user_id': user.id,
        'ip_address': ip,
        'success': success,
        'reason': reason,
    })
    
    # Alert if failed
    if not success:
        user.message_post(
            subject=f"Login attempt from {ip}",
            body=f"Failed login attempt: {reason}"
        )
        
        # Send email alert
        self.env['mail.mail'].create({
            'subject': f'⚠️ Failed login to Odoo from {ip}',
            'email_to': user.email,
            'body': f'Someone tried to log in as {user.login} from {ip}. If this wasn't you, reset your password immediately.',
        }).send()