As a security measure, we are now filtering access to our web service methods only to a small subset of machines, by IP address. Since I am relatively new to the game of testing, I wanted to know if this kind of IP filtering was vulnerable to specific attacks, or what kind of pitfalls to test for using this IP filtering method.
Things I already know: 1. The web service is vulnerable to IP spoofing and DoS attacks
Anything else?
Not sure that I understand your question. But I think if you want be sure that IP filtering works correctly you can test with proxy servers. However it is not easy to tell which security holes can exist on your web service without detail knowledge of this service itself, but you could search all possible web attacks and consult with web service developer/architect asking if specific attack type is technically possible.
Have you tried to use some security test tools such as Web crawler? you can find several tools on https://www.owasp.org/index.php/Main_Page Or if you really want to test your security try BackTrack Linux which contains lots of tools for these kind of testing http://www.backtrack-linux.org/
