How to give work-from-home staff access to IP-restricted Tally or ERP

You restricted the ERP to the office IP, which was a good idea. Now the accountant works from home on Tuesdays and Thursdays and can't log in. Here are the ways to fix that without switching the restriction off.

Last updated 29 October 2026 · 4 min read

The quick fix is to add each person's home IP to the allowlist. It works for about a week, until a router restarts after a power cut and the address changes. A better way to give work-from-home staff access to an IP-restricted ERP is to keep one fixed address on the allowlist and have staff reach the app through it from wherever they are. A fixed IP for remote access is one way to set that up. A VPN to the office is another. Here's how to choose, and what the setup looks like for common apps.

Why IP restriction is worth keeping

A password on its own isn't much protection for your books. Passwords get reused, written on sticky notes and phished. When the app only accepts logins from your address, a stolen password is useless from anywhere else. That's why a lot of business apps offer it:

• Zoho lets admins restrict sign-in to allowed IP addresses, and its help pages say to use static gateway IPs.
• Microsoft 365 uses named locations in Entra Conditional Access, which can hold IPv4 and IPv6 ranges.
• Google Workspace has context-aware access levels based on IP, on its higher editions.
• Many hosted ERPs, admin panels and "Tally on cloud" providers have their own IP restriction setting.

So the aim is to keep the restriction and make it work for people outside the office.

Why home IPs don't work on an allowlist

Home broadband in India is usually dynamic, so the address changes now and then, often after a router restart. Many connections sit behind CGNAT, which means the public address is shared with other customers of the same ISP. Add that to your allowlist and you've let in strangers too. With five people working from home, you'd be managing five moving addresses, some of them shared.

Option 1: a VPN to the office

If the office has a fixed IP and a router or firewall that supports VPN, staff can connect to the office network from home, and their traffic to the ERP leaves from the office IP. It's the traditional answer, and it also gives access to things inside the office, like a file server.

The catches: someone has to set up and maintain the VPN, the office line has to be up for anyone to work, and the office needs a static IP to begin with, which many small offices don't have.

Option 2: one fixed IP that staff route through

This is the setup TrueIP offers. You get a dedicated IPv4 in Mumbai with a proxy login. You put that one address on the app's allowlist. Each person sets the proxy in their browser or system settings, and their visits to the app leave from that address, at home, at the office or on a hotspot.

A few things make this practical for small teams:

• There's no equipment at the office, and nothing depends on the office line being up.
• To cut off someone who has left, change the proxy password. The allowlist stays as it is.
• Microsoft notes that when a proxy is used, Entra evaluates the proxy's IP, so named locations work with this setup as intended.

What it doesn't do: it's for apps that are already online. TrueIP only carries outgoing connections, so it can't reach a PC or file server inside your office. For that, you need the VPN.

Setting it up for staff

Mac

macOS proxy settings take the address, port, username and password. Apple's guide to changing proxy settings on Mac walks through it: turn on the web proxies, enter the host and port, and turn on the option that the proxy server requires a password.

Windows

Windows' manual proxy setup takes only the address and port. There's no username or password field. The browser asks for the login the first time it connects, and Chrome can save it.

A separate browser for work

A tidy way to keep personal browsing off the proxy is to give work apps their own Chrome window with its own settings:

start chrome --user-data-dir="%LOCALAPPDATA%\WorkChrome" --proxy-server="http://HOST:PORT"

Make that a desktop shortcut called "Work apps". Once it's open, visit https://ifconfig.co in that window. It should show your TrueIP address.

What about Tally?

It depends on how you run it. TallyPrime Cloud Access can be used through Chrome, and that route works with a browser proxy like any other web app. Tally's own help says the TPCA client otherwise uses the Remote Desktop app, and so do many third-party "Tally on cloud" hosts.

Remote Desktop has no setting for an HTTP proxy. It can still go through a fixed IP using a small local tunnel, but that's a setup for someone comfortable with the command line, not something to roll out to the whole accounts team. If your Tally host offers a browser option, use that.

Also check whether your Tally or ERP host can actually restrict access by IP. Not all of them can, and the steps differ from host to host, so ask their support.

Quick checklist

• Keep the IP restriction on. Don't add staff home IPs one by one.
• Pick one route: a VPN to the office, or a fixed IP for remote access that staff route through.
• Add the new fixed address to the app's allowlist, and keep the office IP there during the switch.
• Set the proxy for each person, ideally in a separate work browser, and check with ifconfig.co.
• For Tally, prefer a browser-based route. Remote Desktop needs extra setup.

Keep reading