Simple IP whitelisting

[chrisrestall]

Would like to restrict access to a given Route/Destination by the IP of the request. Basically deny if it didn't come from a specific server.

I see how to do this with a custom scheme in aspnet middleware, was curious if there was an OOB way to do this using yarp config.

[MihaZupan]

I don't think there's any built-in IP-based routing support in ASP.NET Core.

A quick search shows that the https://github.com/dustinmoris/Firewall package may be what you are looking for to easily add this as a middleware.

[pinkfloydx33]

I am using this in my YARP proxy. Their rules engine works quite well but I had to customize it a bit to get it to fit with my YARP needs.

For starters I needed a way to create rules from configuration which they don't really have. Then I wrote my own Middleware (based on theirs) that works with custom route/endpoint Metadata to decide which firewall rules to apply on the fly.

All-in-all I'm happy with how it turned out. Depending on your needs it's possible it could work right out of the box. I'd suggest taking a look at it.

[chrisrestall]

We came up with a solution by handling a route match on X-FORWARDED-header + route since all traffic comes through our network appliances upstream beforehand. I'd be curious at peeking at the middleware you created though

[chrisrestall]

I had hope that:
"Hosts" : [ "www.aaaaa.com", "www.bbbbb.com"], // The host names to match, unspecified is any
in a match on the route would do it but isn't host always going to be the yarp server where the request was sent?

[MihaZupan]

Right, the host is Yarp in this case.

[chrisrestall]

so what good is that config setting?

[samsp-msft]

so what good is that config setting?

That config setting is so you can have two routes to /foo, one for www.aaaaa.com, and the other for www.bbbbb.com, which could go to different destinations.

[samsp-msft]

This probably need to be handled by a custom YARP middleware in the proxy. Use the Metadata feature of config to add your own allow list for IP addresses for each route. In the middleware, you can access the route for each request, see if it has that metadata and if so then check the source IP against that data.

[karelz]

Duplicate of #1707

[karelz]

@chrisrestall can you please upvote the linked duplicate? That will help us prioritize it in future. Thanks!

[chrisrestall]

Done!