Whitelisting external server IPs at the gateway.

[prasanna2400]

Hello,I hope you all are doing well. We are using DIGIT for our application and need to integrate a couple of third-party services, which will make calls to our application. Could you please let us know if it’s possible to whitelist the IPs of these third-party servers at the gateway in DIGIT?

[subhashini-egov]

@prasanna2400 This is a standard ChatGPT answer that I got. @naresh-egov @nikhilmulinti @talele08 if you all know of a different approach please share:

Yes, you can whitelist IPs of third-party servers in Spring Cloud Gateway by using a combination of filters and configurations. Here’s an approach to achieve this:

1. IP Filtering at Gateway: Use a RemoteAddrRoutePredicateFactory to match requests based on the IP address. This filter can be added in your configuration file to allow only specific IPs to pass through the gateway.

2. Configuring Whitelisted IPs: Define your IPs in the application configuration file (application.yml or application.properties), where you list the allowed IP addresses under the route configuration.

Example Configuration

In your application.yml file, you could define a route with a remote address predicate like this:

spring:
  cloud:
    gateway:
      routes:
        - id: third-party-api-route
          uri: http://your-third-party-service
          predicates:
            - RemoteAddr=192.168.1.0/24
          filters:
            - StripPrefix=1

This configuration only allows requests from the 192.168.1.0/24 subnet. You can specify individual IPs or IP ranges, depending on the third-party IPs you wish to whitelist.

3. Custom Global Filter (Optional): If you need more complex logic or dynamic control over whitelisted IPs, you could implement a custom GlobalFilter bean. This filter would check the request’s IP address against a predefined list of allowed IPs.

   Here’s an outline of how a custom GlobalFilter might look:

   @Component
   public class IpWhitelistFilter implements GlobalFilter, Ordered {
   
       private static final List<String> ALLOWED_IPS = List.of("192.168.1.10", "203.0.113.15");
   
       @Override
       public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
           String ipAddress = exchange.getRequest().getRemoteAddress().getAddress().getHostAddress();
           
           if (!ALLOWED_IPS.contains(ipAddress)) {
               exchange.getResponse().setStatusCode(HttpStatus.FORBIDDEN);
               return exchange.getResponse().setComplete();
           }
           
           return chain.filter(exchange);
       }
   
       @Override
       public int getOrder() {
           return -1; // Filter order to execute early
       }
   }

In this filter, requests from IPs not listed in ALLOWED_IPS would be rejected with a 403 Forbidden response.

Notes:

• Ensure the gateway has access to the real client IP by configuring the correct X-Forwarded-For headers, especially if your gateway is behind a load balancer.
• Regularly update the whitelist if the third-party IPs change.

This approach offers both flexibility and security for managing IP whitelisting directly at the gateway level.