<p>I want to try and configure a Filter in Envoy Proxy to block ingress and egress to the service based on some IP's, hostname, routing table, etc.</p>

<p>I have searched for the documentation and see it's possible. But didn't get any examples, of its usage. </p>

<p>Can someone point out some example of how It can be done?</p>

<ul>
<li><p>One configuration example is present on this page:
<a href="https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/rbac/v2alpha/rbac.proto" rel="nofollow noreferrer">https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/rbac/v2alpha/rbac.proto</a></p>

<ul>
<li>But this is for a service account, like in Kubernetes.</li>
</ul></li>
<li><p>The closest to what I want, I can see here in this page:
<a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/network_filters/rbac_filter#statistics" rel="nofollow noreferrer">https://www.envoyproxy.io/docs/envoy/latest/configuration/network_filters/rbac_filter#statistics</a><br/></p>

<ul>
<li>Mentioned as, <em>"The filter supports configuration with either a safe-list (ALLOW) or block-list (DENY) set of policies based on properties of the connection (IPs, ports, SSL subject)."</em> </li>
<li>But it doesn't show how to do it.</li>
</ul></li>
</ul>

<p>I have figured out something like this:</p>

<pre><code>network_filters:
   - name: service-access
     config: 
        rules: 
           action: ALLOW
           policies:
             "service-access":
                 principals:
                    source_ip: 192.168.135.211
                 permissions:
                    - destination_ip: 0.0.0.0
                    - destination_port: 443
</code></pre>

<p><strong>But I am not able to apply this network filter. All the configurations give me configuration error.</strong></p>

<p>I would recommend <a href="https://istio.io/" rel="nofollow noreferrer">Istio</a>. You can set up a <code>Rule</code> that will deny all traffic not originating from <code>192.168.0.1</code> IP. </p>

<pre><code>apiVersion: "config.istio.io/v1alpha2"
kind: denier
metadata:
  name: denyreviewsv3handler
spec:
  status:
    code: 7
    message: Not allowed
---
apiVersion: "config.istio.io/v1alpha2"
kind: checknothing
metadata:
  name: denyreviewsv3request
spec:
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: denyreviewsv3
spec:
  match: source.ip != ip("192.168.0.1")
  actions:
  - handler: denyreviewsv3handler.denier
    instances: [ denyreviewsv3request.checknothing ]
</code></pre>

<p>You can match other attributes specified in <a href="https://istio.io/docs/reference/config/policy-and-telemetry/attribute-vocabulary/" rel="nofollow noreferrer">Attribute Vocabulary</a>, for example, block <code>curl</code> command <code>match: match(request.headers["user-agent"], "curl*")</code></p>

<p>More about <a href="https://istio.io/docs/concepts/traffic-management/#ingress-and-egress" rel="nofollow noreferrer">Traffic Management</a> and <a href="https://istio.io/docs/tasks/policy-enforcement/denial-and-list/" rel="nofollow noreferrer">Denials and White/Black Listing</a> can be found in <a href="https://istio.io/" rel="nofollow noreferrer">Istio</a> documentation.
I can also recommend you this <a href="https://github.com/szihai/istio-workshop" rel="nofollow noreferrer">istio-workshop</a> published by <a href="https://github.com/szihai" rel="nofollow noreferrer">szihai</a>.</p>
