0

I have a need to whitelist two sets of 0/23 IPs (which could amount to approx 1200 IPs) along with 10,000-20,000 ports (UDP). We have historically never done it and feel very uncomfortable doing so.

Is there anything we can do to feel secure from a risk and security POV by using a tool or technology, firewall rules, etc that could be used to monitor and ensure the whitelisted IPs cannot be misused?

Improve this question
New contributor
Jay is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
4
  • "... ensure the whitelisted IPs cannot be misused?" - The question is far too broad. It is unknown what you actually need to protect and specifically what misuse means in this context. Based on this it is impossible to say how one could detect such misuse and protect against it.
    – Steffen Ullrich
    Jun 24 at 4:37
  • There are entire billion-dollar industries that exist to monitor and ensure that connected hosts don't misbehave. You are going to have to refine what you want.
    – schroeder ♦
    Jun 24 at 6:57
  • What you asked for is not possible. You want to guarantee that none of the ~1200 computers cannot be attacked, cannot be used by a malicious user, cannot run malware.
    – ThoriumBR
    Jun 24 at 9:55
  • Two /23 CIDRs would be 1024 IPs. The whole point of allowlisting (whitelisting) something is for it to bypass your security systems, so maybe you want to be more selective about what is bypassed? Otherwise, consider requiring those hosts to authenticate through a VPN that you can monitor for abuse, then allowlist that VPN.
    – Adam Katz
    Jun 24 at 14:59

0

Reset to default

Browse other questions tagged or ask your own question.