限制IP地址应该在哪里处理？
我们在应用程序层前面运行反向代理，我想知道处理 IP 限制的“最佳实践”位置在哪里。
目前，我们使用应用程序安全性来限制通过 IP 地址对特定资源的访问，但是当我们转向在反向代理后面运行时，这会导致一些问题。 在代理而不是应用程序上配置允许/拒绝规则非常容易，但由于我们在代理后面运行多个应用程序，对配置进行修改有可能影响其他应用程序（不是一个巨大的危险，但仍然存在） 。
过滤器是放在链的更上游还是更靠近应用程序更好？
是否存在任何问题，就像我们在执行应用程序限制和添加反向代理（其中所有请求“来自”代理）时遇到的问题一样，迫使我们使用标头来查找“真实”IP 地址。
We run a reverse proxy in front of our application tier and I'm wondering where the "best practice" place for handling the IP restriction is.
Currently, we use the application security to restrict access to specific resources by IP address but this has caused some issues when we moved to running behind a reverse proxy. It's quite easy to configure the allow/deny rules at the proxy instead of the application but since we run multiple applications behind the proxy, making modifications to the config there has the potential to affect other application (not a huge danger, but still present).
Is it better to do the filter further up the chain or closer to the application?
Are there any gotchas, like what we've encountered by doing application restriction and adding a reverse proxy where all the requests "come from" the proxy, forcing us to use a header to find the "real" IP address.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我们尽早过滤并使其远离应用程序； 这类事情可以通过网络运营更好地管理。 原因是应用程序开发人员或维护人员在更改 IP 地址时并不总是参与其中，而网络操作人员通常是第一个知道的。 此外，网络类型工具通常比软件级工具更擅长提供/限制访问。
We filter as early as possible and keep it away from the application; these sort of things are better managed by network operations. The reason being is that app developers or maintainers are not always in on the loop when changing ip addresses and the network ops people are usually the first to know. Also network type tools are usually better at providing / restricting access that software level tools.
我永远不会通过IP地址进行限制。 此类限制是安全层的工作，而不是 IP 地址所在的网络层的工作。 我很少发现应用程序限制网络的实现有什么价值。
I would never restrict by IP address. Restrictions like that are the job of a security layer, not of the Network layer, which is where IP addresses live. I rarely find value in having an Application restrict the implementation of the Network.
这取决于需要受IP限制的资源类型。 如果应用程序的某些部分需要通过 IP 进行限制，那么应用程序应该处理它。 如果需要阻止整个应用程序，那么您应该位于链的更上游。
一般规则是在不损害您现有的任何审核系统的情况下尽早进行限制（了解人们何时试图破坏您的安全系统几乎总是一个好主意）。
This depends on the type of resources that need to be restricted by IP. If parts of the application need to be restricted via IP then the application should be handling it. If the entire application needs to be blocked then you should be further up the chain.
The general rule is to restrict as early as possible without compromising any audit systems you have in place (it is almost always a good idea to know when people try to break your security system).
我尽早通过 IP 地址进行限制 - 这消除了后续层或子网中不必要的流量。 所以我的建议与 u07ch 的建议类似，尽早做。
I restrict by IP addresses as early as possible - this eliminates unnecessary traffic in the following layers or subnetworks. So my advice is similar to u07ch's do it as early as possible.