Last updated: July 24, 2026

How to prevent access to MDM server from a specific IP address/FQDN?

To restrict MDM server access to your organization network, stop the MDM server, open the web settings.conf file in the conf folder, and set the ui.access.restricted.hostnames property to the allowed IP address and FQDN. Save the file and restart the server; the server can then only be reached via localhost, the machine's IP, or computer name, blocking access from public IPs or FQDNs.

Description

As an IT administrator, you would want to restrict access to MDM server from outside your organization network/firewall. This ensures MDM server can be accessed only within the organization, thereby securing access to server and the data within. You can achieve this by restricting MDM access to specific IP address/FQDN as explained below:

2Steps

Stop MDM server.
On the machine running MDM server, navigate to <MDM installed folder>/ ManageEngine/MDMServer. Open conf folder.
Open web settings.conf. The conf file has this property ui.access.restricted.hostnames. This is used to restrict access to MDM Server. For example if you want to MDM to be accessed only from the organization intranet, then specify ui.access.restricted.hostnames=252.2.2.33, <MDM machine_public_FQDN>. This ensures the MDM server can be accessed only using localhost:9383, ip-address_of_the_machine:9383 and computer_name:9383. You cannot access the server from public IP address(252.2.2.33:9383) or the pubic FQDN..
Once the host names have been added, save the file.
Start MDM server.

Frequently asked questions

Which file do I edit to restrict MDM server access to specific IPs?

Stop the MDM server, then open the web settings.conf file inside the conf folder and set the ui.access.restricted.hostnames property to the IP address and FQDN you want to allow.

Can I still access the MDM server locally after restricting access?

Yes, after adding the restriction the server can still be accessed using localhost:9383, the machine's IP address, or its computer name; it just can't be reached from a public IP address or FQDN.