<p>My configuration: 
GKE cluster v. 1.15.7-gke.23
istio: 1.4.3</p>

<p>Istio creatd istio-ingressgateway service as Loadbalacner with a default firewall rule:</p>

<ul>
<li>Type: Ingress </li>
<li>Targets: VMs on the GKE cluster </li>
<li>Filters: 0.0.0.0/0</li>
<li>Protocols/ports: tcp:15020,tcp:80, tcp:443,
tcp:15029,tcp:15030,tcp:15031,tcp:15032,tcp:15443</li>
</ul>

<p>My goal is to update <strong>Filters</strong> on the rule, allow access to the endpoint only from allow list IP addresses. </p>

<p>Can it be realized through istio ?</p>

Victor Vedmich
<p>AFAIK it is not possible to affect the istio-ingressgateway Loadbalancer default rules on GCP firewall from istio configuration alone.</p>

<hr>

<p>However,</p>

<p>This kind of filtering can be achieved with use of istio policies. So that the requests will reach the <code>istio-ingressgateway</code> but then will be denied by policies if IP address was not whitelisted.</p>

<p>According to <a href="https://istio.io/docs/tasks/policy-enforcement/denial-and-list/#ip-based-whitelists-or-blacklists" rel="nofollow noreferrer">istio</a> documentation:</p>

<blockquote>
  <p>Istio supports  <em>whitelists</em>  and  <em>blacklists</em>  based on IP address. You can configure Istio to accept or reject requests from a specific IP address or a subnet.</p>
  
  <ol>
  <li><p>Verify you can access the Bookinfo  <code>productpage</code>  found at  <code>http://$GATEWAY_URL/productpage</code>. You won’t be able to access it once you apply the rules below.</p></li>
  <li><p>Apply configuration for the  <a href="https://istio.io/docs/reference/config/policy-and-telemetry/adapters/list/" rel="nofollow noreferrer">list</a>  adapter that white-lists subnet  <code>"10.57.0.0\16"</code>  at the ingress gateway:</p></li>
  </ol>

<pre><code>$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.4/samples/bookinfo/policy/mixer-rule-deny-ip.yaml)
</code></pre>
</blockquote>

<p>Content of <code>mixer-rule-deny-ip.yaml</code>:    </p>

<pre><code>apiVersion: config.istio.io/v1alpha2
kind: handler
metadata:
  name: whitelistip
spec:
  compiledAdapter: listchecker
  params:
    # providerUrl: ordinarily black and white lists are maintained
    # externally and fetched asynchronously using the providerUrl.
    overrides: ["10.57.0.0/16"]  # overrides provide a static list
    blacklist: false
    entryType: IP_ADDRESSES
---
apiVersion: config.istio.io/v1alpha2
kind: instance
metadata:
  name: sourceip
spec:
  compiledTemplate: listentry
  params:
    value: source.ip | ip("0.0.0.0")
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: checkip
spec:
  match: source.labels["istio"] == "ingressgateway"
  actions:
  - handler: whitelistip
    instances: [ sourceip ]
---
</code></pre>

<blockquote>
  <ol start="3">
  <li>Try to access the Bookinfo  <code>productpage</code>  at  <code>http://$GATEWAY_URL/productpage</code>  and verify that you get an error similar to:  <code>PERMISSION_DENIED:staticversion.istio-system:&lt;your mesh source ip&gt; is not whitelisted</code></li>
  </ol>
</blockquote>

<p>The example in documentation has <a href="https://istio.io/docs/tasks/policy-enforcement/denial-and-list/#before-you-begin" rel="nofollow noreferrer">Before you begin</a> part so make sure to meet requirements for <a href="https://istio.io/docs/tasks/policy-enforcement/enabling-policy/" rel="nofollow noreferrer">Enabling Policy Enforcement</a>.</p>

<p><strong>Edit:</strong></p>

<p>To clarify,</p>

<p>Istio and the GCP firewall rules are working at different levels. Istio is only enabled within its mesh, that is, wherever you have the sidecars injected. </p>

<p>In order to make the <code>istio-ingressgateway</code> work, GCE provides a Network Load Balancer that has some preconfigured rules, completely independent from the Istio mesh.</p>

<p>So basically: The GCE firewall rules will only affect the Network Load Balancer attached to the cluster in order to allow traffic into the Istio mesh and the filtering rules in Istio will only work in all the pods/services/endpoints that are within the mesh.</p>
