Solved: IP whitelisting in the internet facing environment... - Page 2

Mitra_Subburaj · 01-17-2025 10:15 AM

Hello ,

We have a usecase where a client asked us to implement whitelisting and allow only a set of IP's provided by them. The public IP's provided by them has been static and we don't have any issues implementing them, but in order to test it and internal purpose, I provided my public IP address , but then its being dynamic. How do we handle this scenario while sticking to the clients requirement? If not, do we any alternate solutions other than mTLS and whitelisting while keeping security in mind

Appreciate any input!

MarciSoos

Hi @Mitra_Subburaj !
Thanks for the details!

If team members are working in such environment that they don't have a Fix IP addres/dedicated IP range, then it doesn't make sense to implement IP filtering, it would mean that your API is available for everybody in this universe.

I suggest you to use the IP filter only as an additional security layer.
For instance, you should implement oAuth, or set up an mTLS, at least request for an Api-key / basic auth.

Before going forward, pls clarify, whether the team members are working remotely, from 100% public internet, or they would use that API via some corporal VPN / internal network?

Best regards,
Marcello

View solution in original post

IP whitelisting in the internet facing environment, where public Ip's are dynamic