7 ms·
Anyone who relies on IP filtering for security deserves to have it broken. Change my mind.
by progbits 6mo ago
Anyone who relies on IP filtering for security deserves to have it broken. Change my mind.
- sebiw 6mo agoDefense in depth is a thing but I agree that relying on it is not a good idea.
- tucnak 6mo agoDefense in depth is not the point, zero trust networking is.
- ignoramous 5mo agoDoesn't appear so. Tailscale is one such "zero trust network", and it does support ACLs anchored on IPs; ex: https://news.ycombinator.com/item?id=47875688 https://news.ycombinator.com/item?id=47875688
- omh 6mo agoI'll take that bait ;-) IP filtering is a valuable factor for security. I know which IPs belong to my organisation and these can be a useful factor in allowing access. I've written rules which say that access should only be allowed when the client has both password and MFA and comes from a known IP address. Why shouldn't I do that? And there are systems which only support single-factor (password) authentication so I've configured IP filtering as a second factor. I'd love them to have more options but pragmatically this works.
- friendzis 6mo agoWhy are you (re-)implementing client security on provider end? If a client requires that only requests from a particular network are permitted... Peer in some way. I do understand the value of blocking unwanted networks/addresses, but that's a bit different problem space.
- apexalpha 6mo agoIP filtering + proper security is better than just having the security. There's value in restricting access and reducing ones attack surface, if only to reduce noice in monitoring.
- anbotero 6mo agoActual curiosity, how would the new filtering be/is? I've done a lot of IP filtering, it's what a lot of systems and services allow us to, so I'm curious what the IPv6 mechanism is