Block Malicious IPs at an API Gateway Across Data Centers
LinkedInSoftware Engineer · Onsite
Last updated
Design gateway IP-block enforcement with trusted client addresses, versioned rules, fast local checks, expiration, and multi-data-center propagation.
Design malicious-IP blocking at an API gateway, then explain how you would extend the design across multiple data centers.
Constraints
The source of malicious-IP decisions, rule volume, request rate, and propagation target are unspecified. Treat detection and enforcement as separate concerns and clarify the policy before choosing defaults. An IP address can be shared by many users, so blocking accuracy and false positives matter.
Clarifying Questions
- Who creates or removes a block, and does a rule have an expiration or scope?
- Are rules exact addresses, network ranges, or both, and do they include IPv6?
- What propagation delay is acceptable for a new block or an urgent unblock?
- What should a gateway do if the control plane is unavailable or its local rule set is stale?
Hints
Hint 1
Keep request enforcement local: Consider how a versioned local rule set can avoid a remote lookup for every request while still receiving reliable updates.
Follow-up questions
- How would you detect that one region missed an unblock event?
- How would you limit harm from a faulty rule that blocks a shared network?
Solution walkthrough is for members
Get the full walkthrough with reference code and complexity analysis, plus Kitty Coach at 300 messages a day. Hints, the code runner and community answers stay free.