Why do B2B clients keep asking to whitelist huge IP ranges?
B2B applications often require manual updates to firewall access lists for dynamic client IPs and large subnets, forcing system administrators to constantly collect, verify, and fight for smaller IP ranges. This tedious process creates an administrative nightmare that risks security best practices by over-whitelisting connections.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
Why do B2B clients keep asking to whitelist huge IP ranges?
- 1Moving to application proxies like Entra ID app proxyDid this help you?
- 2Using Cloudflare Zero Trust and access control rulesDid this help you?
- 3Setting up VPN tunnelsDid this help you?
- 4Routing traffic through proxy nodes with reserved IPsDid this help you?
- 5Pushing back on vendors to refine and shrink their IP listsDid this help you?
- 6Setting up intermediary VMs or separate transfer serversDid this help you?
- 7Using scripts to paste large CIDR blocks in bulkDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“when you send me multiple /27 blocks my immediate response is "f*** off".”source ↗
“It's that whitelisting way more IPs that are actually necessary isn't exactly best practice.”source ↗
“Any chance you can add them via script? So you can just paste the ips in and let it do it's thing?”source ↗
“The issues is why tf do you need me to whitelist half the internet (obviously exaggerating) so you can send me a 10k flat file?”source ↗
“All the time. "Hey bro just allow this IP range for all of US-East-1". I always have to fight for a smaller range”source ↗
“Manually collecting, updating, and maintaining public IPs for multiple client sites is becoming a administrative nightmare, especially when clients have dynamic IPs or remote users.”source ↗
Where this came up
People with this problem also raised
- 3Why won't senior staff let junior admins do anything?
- 4How to block public IP access for RDP while keeping VPN access
- 5Parents paying for wedding but taking over
- 3Is it okay to invite some kids to a wedding but not others?
- 5Why does software installation fail on secure systems?
- 2Why does accounting software force logins for every company file?