Implementing IP Filtering and Access Control
1. Configuring IP Allowlists (CIDR notation)
| CIDR | Range | Hosts |
|---|---|---|
10.0.0.0/8 | 10.0.0.0 - 10.255.255.255 | 16.7M |
172.16.0.0/12 | 172.16 - 172.31 | 1M |
192.168.0.0/16 | 192.168.*.* | 65K |
203.0.113.0/24 | Office subnet | 256 |
198.51.100.42/32 | Single host | 1 |
Example: IP allowlist (Kong)
plugins:
- name: ip-restriction
config:
allow: ["10.0.0.0/8", "203.0.113.0/24"]
status: 403
message: "Access denied"2. Setting Up IP Blocklists
| Source | Examples |
|---|---|
| Static | Known bad IPs |
| Threat feed | Spamhaus, AbuseIPDB |
| Tor exit nodes | torproject.org list |
| Dynamic | Auto-add after N abuse hits |
3. Using Geographic IP Filtering
Example: Geo-block sanctioned regions
geoip2 /etc/geoip2/GeoLite2-Country.mmdb {
$geoip_country source=$remote_addr country iso_code;
}
map $geoip_country $blocked {
default 0;
CU 1; IR 1; KP 1; SY 1;
}
if ($blocked) { return 451; }4. Implementing Dynamic IP Rules
| Mechanism | Example |
|---|---|
| Hot reload | Watch file/Redis set |
| Adaptive ban | Fail2ban-style auto-add |
| TTL expiry | Temp bans auto-clear |
| Severity tiers | Soft warn → throttle → block |
5. Configuring IP Range Validation
| Check | Purpose |
|---|---|
| Bogon detect | Reject private IPs at edge |
| Reserved ranges | 0.0.0.0/8, 127/8 |
| Multicast | 224.0.0.0/4 reject |
| Loopback | Only allow from local proxy |
6. Setting Up Proxy IP Detection
Example: Trust forward header chain
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
# Last untrusted IP becomes $remote_addr| Header | Format |
|---|---|
X-Forwarded-For | client, proxy1, proxy2 |
X-Real-IP | Single original |
Forwarded (RFC 7239) | for=1.2.3.4;proto=https |
| PROXY protocol | TCP-level header |
7. Using IP Reputation Filtering
| Provider | Data |
|---|---|
| Cloudflare | Threat score 0-100 |
| Project Honeypot | Comment/dictionary spam |
| AbuseIPDB | Crowdsourced abuse |
| MaxMind minFraud | Risk score |
8. Implementing IPv6 Support
| Address | Notes |
|---|---|
::1 | IPv6 loopback |
fe80::/10 | Link-local |
fc00::/7 | Unique local (private) |
2000::/3 | Global unicast (public) |
2001:db8::/32 | Documentation |
Note: Listen with
[::]:443 for dual-stack; rate-limit per /64 IPv6 prefix (not /128) since users get whole /64.9. Configuring VPN Detection
| Method | Detection |
|---|---|
| ASN lookup | Datacenter ASNs (AWS, OVH) |
| VPN provider DB | IPQualityScore, IP2Proxy |
| DNS leak | Mismatch IP vs DNS resolver |
| Latency profile | Tunnel adds detectable RTT |