Per-app IP allowlist for internal / company networks (without requiring Cloudron VPN)

[pathab]

We already run a company VPN. For certain Cloudron apps (admin tools, internal services, staging, etc.) we would like to restrict access so they are only reachable from our existing company network / VPN ranges.

The current VPN Protection feature solves a similar problem, but it requires users to connect to Cloudron’s own VPN app. For organizations that already have a VPN or a well-defined internal network, this means running and managing a second VPN just for Cloudron apps, which is unnecessary overhead.

Proposed feature:

Add a per-app setting (similar to “Require VPN”) that allows defining one or more allowed IP ranges (CIDR). Requests from outside these ranges are rejected (e.g. with a 403 or a simple “Access restricted” page).

Example use cases:

• App only reachable from the company VPN / office LAN
• Different apps with different allowlists (public website vs. internal tools)
• No need for an additional VPN client when the user is already inside the company network

Why this is better than only VPN Protection in our case:

• We already have a VPN. Forcing Cloudron’s VPN on top creates friction and support load.
• Source IPs are known and stable when users come through the company VPN.
• Simple CIDR allowlist is easy to understand and configure for admins.

Technically this should be straightforward to implement in the existing reverse-proxy config generation (Nginx allow / deny per app server block), similar to how VPN Protection already injects rules.

Would be happy to help test if this gets implemented.