I’m imagining a system similar to UAC on Windows but implemented at the router level for IP addresses instead. (Or AS numbers, BGP numbers, Port number, etc…)

Naturally this makes router setup slightly more complicated because at least one admin user, or device, will have to be specified and makes usage more of a hassle due to interruptions by the router UAC agent. A sensible whitelist will likely have to come as the default in order for setup to to be easy to use out of the box.

Even so, it seems like a attractive feature for Enterprise customers, security conscious consumers, and even as an optional feature on higher performance routers that already have the necessary performance to implement it. Especially since it needs to be only configured once instead of per device.

Yet, I can’t seem to find any that I can buy right now that offer this kind of security. Which seems odd since it definitely could be a differentiator or a premium feature to charge more for.

Is there something preventing router manufacturer’s from offering this?

  • 1
    If I wanted to connect to Google.com would I have to whitelist the connection every time the DNS sends me to a different IP? As it is, on this page alone I can see at least 7 different IP addresses that my web browser tries to connect out to, am I supposed to add every one of them to a whitelist?
    – user
    May 6 at 13:10
  • 1
    That would be a firewall rather than a router.
    – user253751
    May 6 at 13:51
  • @user All IPs that belong to well known companies and services would probably be included in the whitelist out of the box. If Google decided to add new addresses later that could be included in a whitelist update. I imagine the authorization would only be necessary if Google added an address that they forgot to notify everyone about.
    – M. Y. Zuo
    May 6 at 23:25
  • @user253751 Yes it could be in a separate box, but most routers, especially higher end ones, already come with firewalls and all the necessary computing power. In either case I can't buy an off the shelf solution to accomplish this today.
    – M. Y. Zuo
    May 6 at 23:27
  • @M.Y.Zuo Many routers will let you block IP addresses (or block all and allow some) but there isn't a user interface
    – user253751
    May 7 at 10:19

1 Answer 1


Why don’t routers request permission when attempting to connect to an unknown address?

Routers don't "connect" to addresses. They just forward packets: it is the client who is initiating the connection and the router will just facilitate that the packets reach the destination given by the client.

Or why they still assume every connection is trustworthy

They don't. In fact, they make no assumptions at all about trust but leave such decisions up to the client which usually has more context to make such decisions.

While there might be some IP addresses that are only used for malicious purposes, most IP addresses are not. For example content delivery networks have zillions of domains on the same IP addresses, some of these might be used for malicious purposes, most not. Thus the more relevant context here would be the domain name, and there are DPI or DNS based approaches which provide filtering on the domain name.

But stupidly asking the user with each new IP address or domain name, if they should proceed, would not scale. First, there are many IP address and domains involved when doing normal browsing - so there would be lots of questions. Then, most users don't have a clue if the target is malicious or not just based on the IP address or domain name. On what information should they decide? They have no useful context.

  • How does leaving the decision up to the client resolve the issue of the router connecting to a malicious address, unless somehow the client’s decisions are automatically propagated to all clients connected to the router or if the router adopts the clients decision itself? In the first case that seems unnecessarily complex, why not just do it once at router? In the second case that would require all the overhead and complexity with just letting the router do it + being tied to one client.
    – M. Y. Zuo
    May 6 at 23:29
  • 1
    Why presume you can divide IPs into malicious IPs and benign IPs? What about compromised websites that are not malicious but have malicious content hiding on them? What about CDNs that are just caches for everything and similarly can't be categorized as malicious or benign? There's a small handful of IPs that are worth blacklisting. Everything else is a toss up.
    – user10489
    May 7 at 0:13
  • @M.Y.Zuo As explained in the answer: Routers don't "connect" to anything. Their job is to take what they receive and forward ot to where it has to go. As the answer explains: It's the client making the connection, and thus the burden is on the client to decide who to connect to.
    – user163495
    May 7 at 13:05
  • @MechMk1 Routers certainly do connect to things. I know of at least one router manufacturer that sends over the air updates.
    – M. Y. Zuo
    May 7 at 18:45
  • @M.Y.Zuo: I think you have to differ between actions initiated by some client/device on the network which is passed through by the router, and actions initiated by the router. The context of your question seems to be about the first, i.e. protecting devices/clients by not allowing access to certain IP addresses. If your question is about connections initiated by the router - these should be in full control of the router manufacturer because only its software is running on the router. Giving user control over these connections which are essential for the router would not make much sense. May 7 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.