Access control is used to control which client IP addresses are allowed to access or blocked from accessing a specific virtual service. This feature provides more flexible access control at the load balancing service level, effectively protecting virtual service resources, preventing malicious requests from disrupting normal request forwarding, improving the security and robustness of the load balancer, and ensuring secure access to backend servers.
The ANS network load balancer supports two access control types: blocklist and allowlist. For a given virtual service, only one type can be configured.
Blocklist: Only IP addresses on the list are denied access to the virtual service; all other IP addresses can access it.
Allowlist: Only IP addresses on the list are allowed to access the virtual service; all other IP addresses cannot access it.
As shown in the figure, an allowlist is configured for virtual service 1, allowing only client 1 to access virtual service 1, while a blocklist is configured for virtual service 2, blocking only client 1 from accessing virtual service 2.
When client 1 sends an access request to virtual service 1, the request is accepted because the allowlist only permits client 1 to access it. When client 1 sends an access request to virtual service 2, the request is rejected because the blocklist denies access to client 1.
Similarly, when client 2 sends an access request to virtual service 1, the request is rejected because the allowlist only permits client 1 to access it. When client 2 sends an access request to virtual service 2, the request is accepted because the blocklist only denies access to client 1, and client 2 is allowed to access it.
