# Restrict Countries or Regions from Accessing Your Phone System

Out of the box, Cloud Voice accepts connections from every country and region. Because a reachable phone system is a target, an attacker who reaches yours could place international or long-distance calls, listen in on conversations, or take other actions that put your service at risk. To shrink that exposure, you can restrict access so that only the countries and regions you choose are permitted to connect.

:::caution
Before you can turn on this protection, your own country or region (or your current IP (Internet Protocol) address) must be allowed. Otherwise the feature cannot be enabled, and you could lock yourself out of the portal.
:::

## Turn on country and region access protection

1. Sign in to the PBX (Private Branch Exchange) web portal and go to **Security > Security Settings > Allowed Country IPs**.

2. Switch on **Enable Allowed Country/Region IP Access Protection**.

   Cloud Voice checks whether the IP address you are connecting from is already listed in the **Allow IPs** of your phone system.

3. If your current IP address is not in **Allow IPs**, Cloud Voice determines the country or region your connection comes from and asks you to permit it. You must allow your own location (or IP) before you can use the feature.

   :::note
   Cloud Voice works out your country or region from your public IP address using geolocation lookup. This usually succeeds, but it can occasionally fail (for example, on a newly assigned or unusual address), which is why the two cases below both exist.
   :::

   - When your country or region is identified, a warning icon ![Warning](/images/pbx/warning.png) and a prompt appear so you can permit your current location.

     ![Prompt asking to allow access from your own country or region](/images/pbx/icon-window-prompt-for-allow-own-country-region.png)

     Click **OK** to allow IP addresses from your country or region to reach the phone system. The warning icon ![Warning](/images/pbx/warning.png) clears, and the status for your country or region changes to allowed ![Allowed](/images/pbx/enable-country.png).

     ![Confirmation that access from your own country or region is now allowed](/images/pbx/enable-own-country-access-success.png)

   - When your country or region cannot be identified, a warning icon ![Warning](/images/pbx/warning.png) and a prompt appear so you can permit your current IP address instead.

     ![Prompt asking to allow access from your own IP address](/images/pbx/icon-window-prompt-for-allow-own-ip-address-cloud.png)

     Click **OK** to add your IP address to **Allow IPs**. The warning icon ![Warning](/images/pbx/warning.png) clears, and connections from that address are accepted.

     :::tip
     You can review the address that was added under **Security > Security Rules > Allowed IPs**.
     :::

     ![The current IP address added to the allowed IPs list](/images/pbx/ip-added-to-allowed-ips.png)

4. Allow the other countries or regions that should be able to connect.

   - To allow one country or region:

     ![Allowing a single country to access the phone system](/images/pbx/allow-a-country-to-access-pbx.png)

     a. Type the country or region name into the search box.

     b. In the **Operations** column, set its status to allowed ![Allowed](/images/pbx/enable-country.png).

   - To allow several countries or regions at once:

     ![Allowing multiple countries to access the phone system](/images/pbx/allow-multiple-countries-to-access-pbx.png)

     a. Select the checkbox beside each country or region you want to permit.

     b. Click **Allow**. Each selected status changes to allowed ![Allowed](/images/pbx/enable-country.png).

5. Click **Apply**.

## Result

Only devices whose IP addresses originate in an allowed country or region can reach the phone system.

:::tip
Need to let a single address through from a country or region you have not allowed? Add that address to the allowed IPs list instead. See [Add an Allowed IP Address](/pbx/administrator-guide/add-an-allowed-ip-address/).
:::