<p>I'm using GKE and want to restrict my external load balancers from unwanted traffic. I found two options that problematic for me:</p>
<ol>
<li>Nginx plus + maxmind solution for geo filtering - I'm looking for an open source solution (and the maxmind lite is not available anymore).</li>
<li>GKE Ingress + Cloud armor, but I'm using nginx and other load balancers and not the GKE Ingress.</li>
</ol>
<p>I'm looking for a better solution, maybe in a global kubernetes level implemented as a daemonset or a regular deployment proxy.</p>

<p>i would suggest checking out : <a href="https://lab.wallarm.com/how-to-protect-your-kubernetes-cluster-with-wallarm-configuration-and-finetuning-part-2-of-3/" rel="nofollow noreferrer">https://lab.wallarm.com/how-to-protect-your-kubernetes-cluster-with-wallarm-configuration-and-finetuning-part-2-of-3/</a></p>
<p>And nice <strong>Wallarm WAF ingress controller</strong> : <a href="https://github.com/wallarm/ingress" rel="nofollow noreferrer">https://github.com/wallarm/ingress</a></p>
<p>With <code>Nginx ingress</code>, there are options to increase to security</p>
<p><strong><a href="https://cloudzone.io/implementing-waf-and-mutual-tls-on-kubernetes-with-nginx-modsecurity/" rel="nofollow noreferrer">ModSecurity</a></strong> at application level metadata and proxy payload size management.</p>
<p>For DDoS protection, you can use the <a href="https://medium.com/@chadsaun/mitigating-a-ddos-attack-with-ingress-nginx-and-kubernetes-12f309072367" rel="nofollow noreferrer">rate-limiting</a> and connection handling option</p>
<pre><code>nginx.ingress.kubernetes.io/limit-connections: '2'
nginx.ingress.kubernetes.io/limit-rpm: '60'
</code></pre>
<p>you can whitelist the List of IPs also.</p>
