Ensure An Instance is Allowed to Connect to Only Trusted IP Addresses
Use a system property to define a list of IP ranges that are appended to the outbound IP allow list.
Use the glide.custom.ip.outbound.authenticate.allow system property to define a list of IP ranges that are appended to the outbound IP allow list of an instance. The property value contains a comma separated range of IP addresses in IPv4 or IPv6 format. IP ranges are specified using a hyphen (10.0.10.14-10.0.10.19), using CIDR notation (10.0.10.0/24), or consist of a single IP address (10.0.10.5). The instance is allowed to connect to the IP ranges in this property, unless listed in the IP deny list.
Note: IP ranges in this property are appended to the outbound IP allow list regardless of the value of the glide.ip.authenticate.strict property. The IP Address Access Controls [ip_access] table provides an equivalent option to add to both the inbound/outbound allow/deny IP lists of an instance. Refer to the Steps to Configure section in IP range based authentication.
Ensure that the glide.custom.ip.outbound.authenticate.allow system property value is either an empty, or a comma-separated list containing only trusted IP ranges that your want to allow your instance to access.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.custom.ip.outbound.authenticate.allow |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | String |
| Recommended value | Empty, or a comma-separated list containing only trusted IP ranges that your want to allow your instance to access. |
| Default value | None |
| Fallback value | None |
| Category | Architecture, design, and threat modeling |
| Security risk | - Severity score: 4.3 - CVSS score: Medium - Security risk details: If IP ranges are added to the property, it increases the risk of that an instance may connect to unauthorized or non-essential external services that should otherwise be blocked. This can weaken network-level security. In cases where additional IP ranges are necessary, be careful to include a minimal set of only trusted IPs. |
| Functional impact | There should be no functional impact. It can only be used to increase your instance's access. |
| Dependencies and prerequisites | None |
Parent Topic:Architecture, design, and threat modeling