0

I would like to add a check to Istio to ensure that the source IP address is my load balancer. While not fool proof, I think it would make it more difficult for a attacker to spoof my proxy (where my ssl terminates).

But I can't seem to find a way to do it. I tried adding an AuthorizationPolicy with either an ipBlocks or remoteIpBlocks. But neither work (I am always blocked).

When I run the httpbin sample, the X-Forward-For does not show my Loadbalancer's IP Address. It shows my pc, and an cluster IP (that I can't seem to find what service/pod it goes to).

Here is an example of my AuthorizationPolicy:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:  
  name: ingress-policy
  namespace: istio-testing
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        remoteIpBlocks:
        - 10.60.120.200
  selector:
    matchLabels:
      app: istio-ingressgateway

If I put my PC's IP address in the remoteIpBlockslocation, then it works fine. But I don't want to block based on the calling PC, but on the loadbalancer (that is terminating the SSL and sending another call with the X-Forwarded headers).

I have also tried setting numTrustedProxies: 1, but it seems to have no effect (for this).

How can I block all traffic to my ingress-gateway except traffic that comes from my load balancer?

Note, I am running an on-premises instance of Kubernetes. My load balancer is an F5 BigIP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.