https://johanneskueber.com/tags/security-policy/Recent content in Security-Policy on johanneskueber.comHugoen_USMon, 27 Jul 2026 00:00:00 +0000https://johanneskueber.com/posts/2026-07-27-envoy-gateway-geoip-country-blocking/Mon, 27 Jul 2026 00:00:00 +0000https://johanneskueber.com/posts/2026-07-27-envoy-gateway-geoip-country-blocking/<p>The goal was simple: everything on the public gateway should only answer requests originating from one country. Most of the self-hosted services behind it have no business being reachable from the other side of the planet, and a country allowlist at the edge cuts the background noise of credential-stuffing and vulnerability scanners down to almost nothing before a request ever reaches an application.</p> <p>Envoy Gateway can do this natively since v1.8 with the MaxMind GeoIP filter and an authorization <code>SecurityPolicy</code>. The configuration is small. Getting it to actually apply, however, took a detour through a translator bug that freezes the entire control plane — so this article covers both the working configuration and the problems encountered on the way there.</p>