diff --git a/roles/custom/matrix-synapse-admin/defaults/main.yml b/roles/custom/matrix-synapse-admin/defaults/main.yml
index 9fcf9532e..50ebe9098 100644
--- a/roles/custom/matrix-synapse-admin/defaults/main.yml
+++ b/roles/custom/matrix-synapse-admin/defaults/main.yml
@@ -49,6 +49,11 @@ matrix_synapse_admin_container_labels_traefik_priority: 0
 matrix_synapse_admin_container_labels_traefik_entrypoints: web-secure
 matrix_synapse_admin_container_labels_traefik_tls: "{{ matrix_synapse_admin_container_labels_traefik_entrypoints != 'web' }}"
 matrix_synapse_admin_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+# This setting is to define a list ip addresses to allow access to synapse-admin.
+# Each IP address should be in CIDR format, e.g. xxx.xxx.xxx.xxx/xx.
+# For more information, see: https://doc.traefik.io/traefik/middlewares/http/ipallowlist/
+# If the list is empty, all IP addresses are allowed.
+matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange: []
 
 # Controls which additional headers to attach to all HTTP responses.
 # To add your own headers, use `matrix_synapse_admin_container_labels_traefik_additional_response_headers_custom`
diff --git a/roles/custom/matrix-synapse-admin/templates/labels.j2 b/roles/custom/matrix-synapse-admin/templates/labels.j2
index b4e973e00..eeb29756e 100644
--- a/roles/custom/matrix-synapse-admin/templates/labels.j2
+++ b/roles/custom/matrix-synapse-admin/templates/labels.j2
@@ -9,6 +9,11 @@ traefik.http.services.matrix-synapse-admin.loadbalancer.server.port=80
 
 {% set middlewares = [] %}
 
+{% if matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | length > 0 %}
+traefik.http.middlewares.matrix-synapse-admin-ipallowlist.ipallowlist.sourcerange={{ matrix_synapse_admin_container_labels_traefik_ipallowlist_sourcerange | join(',') }}
+{% set middlewares = middlewares + ['matrix-synapse-admin-ipallowlist'] %}
+{% endif %}
+
 {% if matrix_synapse_admin_container_labels_traefik_path_prefix != '/' %}
 traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.regex=({{ matrix_synapse_admin_container_labels_traefik_path_prefix | quote }})$
 traefik.http.middlewares.matrix-synapse-admin-slashless-redirect.redirectregex.replacement=${1}/