I use client certificate authentication (or mTLS) to access internal services. It requires the client device to present a digital certificate during the TLS handshake, so I don’t need to white list any IP addresses.