IP Address & Time-Based Login Restrictions for Odoo 19 documentation

A guide to IP address and time-based login restrictions: rules per user or group, addresses and time windows, what is covered, the test tool, the log, and how not to lock yourself out.

Documents version 1.0.0Updated Oct 23, 2026

About IP Address & Time-Based Login Restrictions for Odoo 19 Download the PDF(PDF, 1.3 MB)

Start here

In plain words: A password is the only thing between the internet and your accounting. Staff reuse passwords, share them, and type them on any computer. This module adds two simple, strong limits that most companies already want: people sign in only from your office or VPN addresses, and only during working hours. Different rules for different teams, and the rules are enforced everywhere Odoo can be entered.

The right password, from the wrong place: the person is refused, with your own message.

You set	Odoo does
Allowed IP addresses for a user or user group	Refuses the sign-in from any other address, even with the right password.
Allowed days and hours (with a time zone)	Refuses sign-ins outside them, and can sign people out when the window closes.
Exceptions	Lets chosen users or groups out of a rule. Administrators are exempt by default.

Tip: Every refusal is logged, a test tool tells you in advance what a given person would get, and the module refuses to save a rule that would lock you out.

How the rules work

Question	Answer
Who does a rule apply to?	The user groups and users you list. Leave both empty to apply it to everybody. A group counts with the roles it implies (a Sales Administrator is also a Sales User).
Who is let out?	Anybody under “Except these groups / users”. Administrators (Settings / Administrator) are exempt unless you tick “Also apply to administrators”.
Several rules?	A person must satisfy every rule that applies to them.
Address and time in one rule?	Both must be satisfied: the right address and the right time.
Several time windows?	Any one of them is enough.
A rule with neither limit?	It is not allowed: tick at least one.

In plain words: The check happens after the password has been verified, so a stranger who does not know the password never learns anything about your rules.

Requirements

Item	Details
Odoo	19.0 (Community or Enterprise)
Apps needed	Only the base (`base` and `web`)
Who can configure it	Administrators (Settings / Administrator)
License	OPL-1 (Odoo Proprietary License v1.0)

Install

Unzip the package. Inside is taqnix_login_restrictions.zip; unzip it to get the folder taqnix_login_restrictions.
Copy the folder into one of the addons_path folders of your Odoo server and restart Odoo.
Log in as an administrator, activate Developer mode, open Apps and press Update Apps List.
Remove the “Apps” filter, search Login Restrictions and press Install.

# or from the command line
./odoo-bin -c odoo.conf -d YOUR_DATABASE -i taqnix_login_restrictions --stop-after-init

Important: Installing does not block anybody: there is no rule until you create one. If Odoo runs behind a reverse proxy (Nginx, Apache, a load balancer), read chapter 6 before you create address rules.

Create a rule

In plain words: Open Settings → Users & Companies → Login Restrictions and press New.

A rule for the sales team: office and VPN addresses, working hours, and a message.

Section	Field	What it does
Who	User groups / Users	Whom the rule applies to. Both empty: everybody.
Who	Except these groups / users	People who are not subject to this rule.
Who	Also apply to administrators	Off by default, so an administrator can always fix a wrong rule.
What happens	Also end open sessions	Sign people out when they break the rule while already signed in (chapter 9).
What happens	Message shown	Shown on the login page after the right password. `{ip}` becomes the person's address.
What happens	Your address now	The address Odoo sees for you: check it before you create address rules.
Where from	Allow only these IP addresses	Tick it and list the addresses.
When	Allow only these times	Tick it and add one or more time windows.

The time windows: days, hours and a time zone.

IP addresses

In plain words: List the allowed addresses one per line, or separated by commas. Text after # is a comment.

Write	Means
`203.0.113.7`	One address
`10.0.0.0/8`	A whole network (CIDR)
`192.168.1.10-192.168.1.50`	A range
`192.168.1.*`	A wildcard: 192.168.1.0 to 192.168.1.255
`2001:db8::/32`	An IPv6 network (single IPv6 addresses work too)

Important: Behind a reverse proxy? Odoo only sees the proxy's address unless you start it with proxy_mode = True in odoo.conf and the proxy sends X-Forwarded-For. Check the field Your address now in a rule: it must show your address, not the proxy's. Without proxy mode every person would look like they come from the proxy.

Tip: Many home connections change address. For people who work from home, use a VPN with a fixed address and allow the VPN's range.

Time windows

Detail	How it works
Days	Tick the days of the window. Weekends are off by default.
From / Until	Hours of the day. “Until” itself is not included: 8:00–18:00 allows 17:59, not 18:00.
Night shifts	If “Until” is earlier than “From” (22:00–06:00), the window runs past midnight. Its day is the day it starts: a Monday 22:00–06:00 window lets people in until Tuesday 06:00.
Time zone	Each window has its own, so a branch in another country can have its own hours.
Several windows	Any one is enough, for example 8:00–12:00 and 14:00–18:00.
The server clock	The check uses the server's clock, converted to the window's time zone.

What the person sees, and where it applies

In plain words: After the right password, a person who breaks a rule gets the message of the rule instead of being signed in. A wrong password still says “Wrong login/password”.

Entry point	Covered
The login page (password, passkey)	Yes
The web client session login (JSON-RPC)	Yes
XML-RPC and JSON-RPC `authenticate`	Yes
XML-RPC / JSON-RPC calls that send the uid and the password (or an API key) every time	Yes
People already signed in	Yes, when “Also end open sessions” is ticked (chapter 9)
Public website visitors, scheduled actions, server actions	Not affected: they do not sign in as a person

People who are already signed in

In plain words: Someone who signed in at 17:50 should not still be working at midnight. With Also end open sessions ticked, the next click after the window closes (or after the address changes to a forbidden one) signs the person out and takes them to the login page, where the rule then explains why they cannot come back in.

Tip: Untick it for a rule that should only guard the moment of sign-in.

Test a login first

In plain words: Settings → Users & Companies → Test a Login (or the button on a rule) answers “what would happen if…?” without signing anybody in.

From an address that is not on the list.

From a good address, but at a time outside the windows.

In plain words: Pick a user, an address and a moment. The result says Allowed, Blocked by rule … with the reason, or that no rule applies, and lists the rules that apply to the user.

The log of blocked sign-ins

In plain words: Every refusal is written to Settings → Users & Companies → Blocked Logins: when, the login, the address, the reason, the rule, and where it came from (login page, API call, or an open session that was ended).

Blocked sign-ins, with the reason and the rule.

In plain words: Entries are kept for 90 days. Each rule also shows how many sign-ins it blocked in the last 30 days.

Protecting yourself

Safeguard	What it does
Lock-out guard	Odoo refuses to save a rule that would block you right now, with an explanation.
Administrators exempt	Not subject to a rule unless you tick “Also apply to administrators”.
Test a Login	See the effect before you rely on it.
The off switch	If the worst happens, set the environment variable `TAQNIX_LOGIN_RESTRICTIONS=off` for the Odoo process and restart: every rule is ignored. Remove it when you have fixed the rule.

Saving a rule that would block the administrator who is saving it.

# start Odoo with every rule switched off
TAQNIX_LOGIN_RESTRICTIONS=off ./odoo-bin -c odoo.conf

# or deactivate the rules from the command line
./odoo-bin shell -c odoo.conf -d YOUR_DB <<< "env['taqnix.login.rule'].search([]).write({'active': False}); env.cr.commit()"

What it is, and what it is not

Not covered	What to do
A replacement for a firewall, a VPN or two-factor authentication	It is one more layer. Use it together with them.
Spoofed addresses	The address comes from the connection (or from your proxy). Only run Odoo behind a proxy you control.
Other login routes added by third-party modules	They are covered when they use Odoo's standard sign-in. Test yours with a real attempt.
Restricting what people do after signing in	Use Odoo's access rights for that.
Time zones of the people	Windows use the time zone you set, not the person's.

For developers

In plain words: Skip this chapter if you only use the module.

Item	Details
Hooks	`res.users._login` and `res.users._check_uid_passwd` call the engine after the credentials are verified; `ir.http._authenticate_explicit` checks open sessions.
Engine	`taqnix.login.engine`: `check(user, ip, now_utc)` returns `(rule, reason)`, `enforce(uid)` raises `AccessDenied`.
Models	`taqnix.login.rule`, `taqnix.login.window`, `taqnix.login.attempt`.
Address helpers	`models/iptools.py`: `parse_list`, `ip_in_list`.

engine = env['taqnix.login.engine']
rule, reason = engine.check(user, '198.51.100.7')   # (rule, 'ip') or (None, None)

from odoo.addons.taqnix_login_restrictions.models import iptools
iptools.ip_in_list('10.1.2.3', iptools.parse_list('10.0.0.0/8'))   # True

Troubleshooting

Problem	What to do
Everybody is blocked, including people in the office	“Your address now” shows a proxy address: enable `proxy_mode` and the `X-Forwarded-For` header, or list the proxy's address.
I locked myself out	Start Odoo once with `TAQNIX_LOGIN_RESTRICTIONS=off` and fix the rule.
A rule does not apply to a person	They may be an administrator (exempt), or in an excepted group, or not in the rule's groups. Use Test a Login.
The time seems wrong	Check the window's time zone and the server clock.
People are signed out in the middle of the day	“Also end open sessions” is ticked and the window closed or the address changed. Untick it, or widen the window.
A person says “Wrong login/password”	The password is wrong. Rule refusals show the rule's message instead.

Updating and removing

Replace the folder with the new version, restart Odoo and run -u taqnix_login_restrictions. Your rules are kept. To remove it, uninstall it from Apps: every restriction disappears at once and the log is deleted.

Support

Installation help and bug fixes are included for 6 months, with lifetime updates. Contact us through the marketplace page where you bought the module or write to support@taqnix.com with your Odoo version and a screenshot.