automating IP removal from an allow list with python
A Python script that reads a text-based allow list, removes a set of unauthorized IPs, and writes the cleaned list back.
The problem
A simulated environment maintains an allow list of IP addresses in a text file (allow_list.txt). Periodically, some IPs need to come off the list. Doing this by hand is error-prone the moment the list is more than ten entries long, and the operation itself is the kind of thing that wants to live in version-controlled code.
This is a short script that does the job.
Reading the file
1
2
3
import_file = "allow_list.txt"
with open(import_file, "r") as file:
ip_addresses = file.read()
Reading the file.
Opening in read mode ("r") gives us the raw text. The with block closes the file automatically when we exit the block, which is the only reason to use it over a bare open().
Splitting into a list
1
ip_addresses = ip_addresses.split("\n")
String to list.
split("\n") turns the multi-line string into a list of lines. Each line is an IP, so each list element is one IP address.
Removing the unauthorized entries
1
2
3
4
remove_list = ["10.0.0.5", "172.16.0.3"]
for element in remove_list:
if element in ip_addresses:
ip_addresses.remove(element)
The remove list.
Iterating and removing.
For each IP in remove_list, check if it appears in the allow list and remove it if so. .remove() deletes the first occurrence; that is fine here because IPs are unique in the source file.
If duplicates were possible, a list comprehension would be safer: ip_addresses = [ip for ip in ip_addresses if ip not in remove_list].
Writing back
1
2
3
ip_addresses = "\n".join(ip_addresses)
with open(import_file, "w") as file:
file.write(ip_addresses)
Writing the cleaned list back.
"\n".join() reverses the earlier .split("\n"), putting the list back into the file’s original shape. Opening in "w" mode truncates the file before writing, so the result fully replaces the previous contents.
What this is actually useful for
The script itself is small. The pattern is what matters: read a structured config file, mutate it programmatically, write it back atomically. The same shape applies to firewall config, DNS zone files, /etc/hosts, allow lists, deny lists, anything text-based.
What is missing here, and would matter in production:
- File locking, so two runs cannot race each other
- A backup copy before overwriting, so you can recover from a bad input
- Validation that the input file actually looks like an IP list before mutating it
- Logging what was removed, with timestamps, for audit purposes
For a self-contained exercise this script is enough. For something that actually controls who can reach a system, those additions are the difference between “automation” and “automation that will eventually delete the wrong thing”.