IP Filtering policy
The IP Filtering policy lets you control access to your API via IP addresses. You can allow or deny a specific IP address or a range of IP addresses by using CIDR.
The allow list mode excludes all IP addresses excepts those with an IP address that is part of the allow list. The deny list mode allows all IP addresses except those with an IP address that is part of the deny list.
If an IP address is part of the deny list and the allow list, the policy rejects the request.
When using domain name, the Gateway performs DNS Lookup with the DNS server configured on the host by default. To use a specific DNS server, you can configure it at the policy level by adding the following custom container properties to the gateway. You must restart the gateway to apply this.
com.boomi.container.apigateway.policy.ipfiltering.dns.host = 8.8.8.8
com.boomi.container.apigateway.policy.ipfiltering.dns.port = 53
Timing
| On Request | On Response |
|---|---|
| X |
Configuration
| Property | Required | Description | Type | Default |
|---|---|---|---|---|
matchAllFromXForwardedFor | no | If set to true, the policy parses each IP address from the X-Forwarded-For header parameter. Note: When matchAllFromXForwardedFor is set to false, the gateway might accept an API request from a non-allowed IP address based on the X-Forwarded-For header. The policy treats the first item in the X-Forwarded-For list as the client IP address, so if the allow list also includes that IP address, the policy allows the request. If it is not the first item in the list, the policy returns a 403. | boolean | false |
whitelistIps (allow list) | no | List of allowed IP addresses with or without CIDR notation. | string list | empty |
blacklistIps (deny list) | no | List of denied IP addresses with or without CIDR notation. | string list | empty |
ipAntiSpoofing | no | If the ipAntiSpoofing feature is set to true, the configuration will ensure that all the IP addresses in the X-Forwarded-For header are in the allowed list of IP addresses. If the X-Forwarded For header includes any IP addresses that is not in allowed list, then the system will return the 403 error. | boolean | false |
The ipAntiSpoofing configuration takes precedence over the matchAllFromXForwardedFor configuration when both are enabled.
Example
{
"ipAntiSpoofing": false,
"matchAllFromXForwardedFor": true,
"whitelistIps": [
"10.0.0.1",
"10.0.0.2/10"
],
"blacklistIps": []
}
HTTP status Code
| Code | Message |
|---|---|
| 403 | Your IP address (0.0.0.0) or proxies where your request pass through is not allowed to reach this resource |
