Can you provide no knowledge SaaS, if server only serves requests with a VPN/Tor IP address?

Question

to protect users you would reject serving requests originating from non-VPN/Tor IP addresses.

how can you get and keep updated a list of

1. the Top/most secure VPN providers's IP addresses? (others won't be approved by/work with the service)
2. Tor exit nodes IP addresses?

Answer 1

Tor exit nodes can be listed with https://check.torproject.org/cgi-bin/TorBulkExitList.py, or you can get them programmatically like a DNS lookup using https://www.torproject.org/projects/tordnsel.html.en

The problems with listing VPN IP addresses are many:

• There are many VPN providers, and they change frequently;

• Some VPN providers provide reasonable security, many do not, and it's extremely difficult to verify;

• Users can roll their own VPN using a cloud service;

• Many VPNs do NOT want their IP addresses known, and may even change
  them regularly, in order to increase protection for their users.