Ryfujk

In the following scenario, I'm looking to see if I can provide adequate security as is or if there would be any tangible benefit to re-architecting things (like changing it so that the service in question would be in a DMZ, or something like that). Assume that the data I'm trying to protect is highly sensitive and it would be a major headline if it got exposed.

• On a server that has access to the internal network (because we also need to access a database or other internal services), there will be a gRPC service that listens on a specific TCP port.


• I know in advance that I only want a client from a single known, trusted IP to connect in, so we'll create a rule in the external firewall to allow incoming TCP connections from that single IP to the IP endpoint of the gRPC service.


• For encryption and authentication, we'll also be doing TLS 1.2 mutual authentication on the gRPC service.

As far as what I've been able to think of, this should be more than acceptable because the only way to be able to connect in on that port would be to either legitimately have that IP (and it's a static IP where we trust the entity that the IP has been assigned to) or to spoof it, and a potential attacker would have to know that you would have to spoof that specific IP, which seems very unlikely without insider information (and even then, you'd only be able to send in packets trying to damage things and wouldn't get responses back because they'd route to the real IP, right?). Assuming that a malicious actor were to gain control of that IP, they'd still have to have the appropriate certificate to get through the TLS piece, know the type of protocol that they're trying to exploit, potentially need application-layer credentials, etc. I only see this as a likelihood if the actual client machine that I expect to connect in gets compromised; as far as I know, it has good physical/network security around it, so I think this should be very improbable.

Additionally, what about if I didn't firewall it at all? Would the security level still be acceptably high since you'd have to either have a legitimate certificate signed by the same CA as the server's certificate, or have an exploit up your sleeve in order to get past the TLS authentication? I'd firewall it either way since there really is just a single client I want connecting in, but I'm also curious about this.

Are there other issues that I'm not thinking about, or any other good reasons that should lead me to abandon this sort of setup as insecure? Thanks in advance.