Re: UI for whitelist unauthenticated connections from public IP address

I think I would suggest all of the subnets you mentioned (10.0.0.0/8, etc) _in addition to_ the local subnets of the local net interfaces. Would be good to make sure there's consensus on this, though. -Todd On Mon, May 1, 2017 at 11:35 AM, Hao Hao wrote: > Thanks Todd! If I understand you corr

Re: UI for whitelist unauthenticated connections from public IP address

Thanks Todd! If I understand you correctly, you are suggestion besides local subnets(127.0.0.0/8), instead of providing default trusted non-routed subnets(10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 , etc.), only 'includes the full local subne

Re: UI for whitelist unauthenticated connections from public IP address

The one thing that I think we should consider in addition to the trusted (local) subnets is to also include the full local subnets of any local network interfaces. That is to say, we can iterate over the network interfaces, look at their address and netmask, and include anyone in the same network.

Re: UI for whitelist unauthenticated connections from public IP address

Hi Dan, Thanks a lot for your response! Here is my thoughts about your questions inline. * Should we include the link-local block, 169.254.0.0/16? It seems this is mostly used for DHCP discovery, so maybe it's not necessary (I think it's better to be overly restrictive here than overly permissiv

Re: UI for whitelist unauthenticated connections from public IP address

Hi Hao, First off, thanks for working on this. I think it's crucial to avoid the bad reactions that a lot of other databases have been getting recently. Secure by Default! I like the idea of a 'trusted-subnets' flag, which defaults to the private and loopback address blocks. E.g. something alon

UI for whitelist unauthenticated connections from public IP address

Hi everyone, In the work of refusing from publicly routable IP addresses (KUDU-1875), it would be useful to provide users a way to whitelist any 'trusted' but publicly IP address. So that unauthenticated connections coming from those public IP addresses will not be rejected. One way I am proposin