Allowlist for IP address

[#1]

Hello Team,

I have a proxy which used by multiple partners and now have to allow only those network range IP(partner specific)...

I am using access control policy to allow-list the specific IP address to access my proxy. But it is still allowing us to access the proxy. if I check my ip address by ipconfig and add same in access control policy, still it is allows us to access the proxy. Next thing is if i check my ip address in trace it shows different ip address(proxy.client.ip) and I have a proxy which used by multiple partners and now have to allow only those network range IP(partner specific)...Need help....

[dchiesa1]

ok, thanks for the description. You're using an AccessControl policy. It sure looks like the policy is not doing what you expect it to do: restrict calls to those that arrive from a specific set of IP addresses.

But we can't answer without additional information .

Can you SHOW or DESCRIBE

• the specific configuration of the policy
• how you've attached that policy.

With Apigee Edge, there is the possibility to

• select one or more policies (like AccessControl, AssignMessage, VerifyApiKey, and so on)
• attach those policies to a specific attachment point

That's how it works.

It is possible to have an AccessControl policy (or any policy), included in your API Proxy, that is unattached. It may be unfortunate that this is possible, but it is possible. If you have a configuration like this, then the policy in question will never execute.

So we need that additional information in order to be able to diagnose.

[shawkyfoda]

How We Could Really Protect Service With IP Allow-listing, while attacker can deceive the policy by using the "X-Forward-For" Header populated with a valid IP ?

[dchiesa1]

Good question Shawky. A better way to go is to enter Apigee through a WAF, in which case you can have greater assurance about the asserted IP address in XFF. For example, use Apigee X with Google Cloud Armor.

[shawkyfoda]

Thank You Mr. Dino,

This means we could not rely on apigee controlAccess policy?

Actually I have advised to replace the WAF whitelisting protection with Apigee. So you do not advise so?

[#6]

In that case you can use mutual TLS, that will be the best security to authenticate your user.