How do I whitelist a dynamically changing application sync server IP ?

Submitted ⁨⁨1⁩ ⁨year⁩ ago⁩ by ⁨mathiuscov@programming.dev⁩ to ⁨linux@programming.dev⁩

cross-posted from: programming.dev/post/2768533

I have a vm for which I have s specific whitelist only firewall. It is supposed to only allow connections to the IPs an app connects to when syncing.

I first got the sync server IP’s listening to tcpdump, then when I had the IP’s I activated the whitelist.

This worked perfectly for some time, but now it appears that the IP’s have changed. I could do the same thing again but repeating the process regularly is annoying and defeats the whole purpose of only ever allowing network connections to specific whitelisted serves.

Alternatively, I could set up a process to only allow network traffic from that app somewhat.

Using debian-11 btw.

Any help is appreceated !!!

source

Comments

Sort:hotnew top

vzq@lemmy.blahaj.zone ⁨1⁩ ⁨year⁩ ago
IP white lists are, as you have found out, essentially dead. You should just do proper authorization.

source
- mathiuscov@programming.dev ⁨1⁩ ⁨year⁩ ago
  wym look into a vpn? How would that work?
  
  source
Chobbes@lemmy.world ⁨1⁩ ⁨year⁩ ago
If you want this service to only be available privately, it would probably make sense to stuff it behind a VPN like wireguard, instead of making it open to the public and only accessible by specific ips.

source
- mathiuscov@programming.dev ⁨1⁩ ⁨year⁩ ago
  wym look into a vpn? How would that work?
  
  source
  - Chobbes@lemmy.world ⁨1⁩ ⁨year⁩ ago
    Ah! People think of VPNs a bit narrowly now because of all of the commercial VPN companies, but VPNs can really be what they say on the tin “virtual private networks”. Basically you set aside a private IP range for your network and you can tunnel traffic between devices as though they’re all on one big LAN. This is often used to access internal resources remotely, and the VPN is used to authenticate your access to various servers. So, for example I can access my home servers to clone git repos or whatever from a wireguard VPN, but those servers are otherwise not exposed on the broader internet.
    
    I think I’m confused about your use case, though. You’re using somebody else’s sync servers, but you can have an IP blocklist on them? What do you mean your app connects to the sync server? What devices is the app running on? Is it just your personal devices, or is it an app that other people would use? I think some more details might help people get you to the right solution.
    
    source
Nath@aussie.zone ⁨1⁩ ⁨year⁩ ago
There’s no tidy way to do it. You can configure a dynamicDNS from the dynamic IP, then set up a cron from the server to check that record every hour or so. Update the whitelist accordingly.

The other way to do it is to have an intermediate jump point and whitelist that.

Both have their drawbacks. I’d personally go the dyndns route. But I’d be sure a had a static IP I could ssh from as a fallback in case I had problems. You don’t want to lock yourself out.

source
SteveTech@programming.dev ⁨1⁩ ⁨year⁩ ago
Could you explain what the app is?

You could maybe find the company’s IP range and whitelist that, or just whitelist the port it’s using.

But as you’ve seen from the replies, the information you’ve given is very vague.

source