As the question states; what is the point of firewall rules that target specific IP addresses? E.g. machine 192.168.10.1 on VLAN 10 is allowed to access machine 192.168.20.1 on VLAN 20. Both with static IPs and DHCP there are absolutely no guarantees that a specific IP address will point to a specific server, or am I completely missing something?
I can just manually request a static IP or exhaust the DHCP pool to wrap around and obtain the IP address I want. I’ve seen these IP based rules implemented quite a few times and I was wondering what the point was from a security perspective.
In that light, how would one go about setting up solid firewall rules? To me the best approach seems to be to isolate every server into their own VLAN and create rules on the VLAN level, though this might not be feasible in a large scale setup.
TLDR; what is the point and how could one accomplish machine-granularity with firewall rules?
