Can't make app VPN protection work

[bazinga]

Extension: Supporting Inbound Proxies (Xray / 3X-UI) to access VPN protected apps

If you are running an inbound proxy server (like Xray via a 3X-UI panel) that connects to your OpenWrt router (e.g., as a client on an inbound wgserver tunnel like 10.4.0.3), Xray will naturally try to use its own application-layer routing and public DNS. This bypasses the router's PBR engine and triggers the "VPN connection required" block. To fix this, you must instruct Xray to natively map your Cloudron domains directly to the internal CGNAT/Docker IP address that your router's PBR engine is already intercepting.

Step 1: Update the Xray DNS Config Template (3X-UI)

1. Log into your 3X-UI panel and confirm DNS is enabled (Xray Configs -> DNS tab)
2. Navigate to Xray Configs -> Advanced tab (or your core JSON configuration template).
3. Locate the "dns" configuration block.
4. Manually add a "hosts" mapping block right above your "servers" array, explicitly binding your app domains to the routed internal Cloudron IP (100.64.0.1):

"dns": {
    "hosts": {
      "my-app.domain.net": "100.64.0.1",
      "my-other-app.domain.net": "100.64.0.1"
    },
    "servers": [
      {
        "address": "localhost",
        "port": 53,
        "skipFallback": true
      },
      {
        "address": "1.1.1.1",
        "port": 53,
        "skipFallback": false
      }
    ],
    "queryStrategy": "UseIPv4",
    "tag": "dns_inbound"
  }

5. Click Save/Update Config and Restart Xray Service.

Step 2: Ensure Router PBR Policy is Set to Catch-All

On your OpenWrt router, make sure your policy rule seamlessly captures this traffic, regardless of whether it originates from a local LAN machine or your proxy's inbound tunnel interface IP (10.4.0.3).

1. Open VPN Policy Routing screen.
2. Verify or create a rule matching this exact profile:
   • Local Addresses / Devices: Leave completely blank (This creates a global catch-all rule for all local and tunnel interfaces).
   • Remote addresses / domains: 100.64.0.1
   • Interface: Select your outbound Cloudron WireGuard interface (wg_cloudron).
3. Click Save & Apply.

[timka]

@bazinga

@bazinga said:

One question: why did you guys opt for this VPN protection vs simply allowing users to define a white list of source IPs or domains from where the access would be allowed? Would be much simpler and not require the VPN hassle (no matter on an endpoint or a router).

Well, someone requested it ^^. If I remember correctly ++

[necrevistonnezr]

Not everyone is on a fixed IP all the time (residential addresses, mobile networks, etc.)

… but why not both? Open a request

[bazinga]

@necrevistonnezr "Not everyone is on a fixed IP" -> hence the "domain" part of my question. Dynamic dns does wonders. And if anyone wants to protect their traffic on open WiFi, then VPN'ing to your actual home/office/whatever, which in turn has its IP whitelisted, makes way more sense to me.

[p44]

@bazinga said:

One question: why did you guys opt for this VPN protection vs simply allowing users to define a white list of source IPs or domains from where the access would be allowed? Would be much simpler and not require the VPN hassle (no matter on an endpoint or a router).

I tried to use Blocked IPs & ranges feature adding all IP’s list unless the specified IP but VPS became unresponsive.

I agree to enable an allow list that, when enabled, blocks everything unless specific IP.

[girish]

I think if we do a simple IP whitelist/blocklist, the onus is on the Cloudron admin to manage all this. Users come and go, move between places, have dynamic IPs etc. But sure, this can be added to, if it's seen as beneficial over VPN.

[p44]

@girish said:

I think if we do a simple IP whitelist/blocklist, the onus is on the Cloudron admin to manage all this. Users come and go, move between places, have dynamic IPs etc. But sure, this can be added to, if it's seen as beneficial over VPN.

Vurrent VPN system is perfect and gives a certain level of granularity.

[jdaviescoates]

@girish sounds like both options could be useful.

eg if there was a simple way to simply whitelist my own ip and block everything else, that probably would've been easier and quicker than setting up VPN access for dozens of apps (not that I did that, I just stopped all php apps).

Might've been useful when restarting the apps to update them too?

[bazinga]

@girish If someone wants very complex setup - sure, they can opt for the VPN solution (even though I don't see that as a simple setup either). But whitelisting home / office IPs is very easy. Dynamic IPs are covered by dynamic dns.

VPN protection for bunch of users means every device needs a VPN (unless you go through the pain I've gone through), the server has to deal with many VPN tunnels, which isn't free either.

[necrevistonnezr]

@bazinga said:

@girish If someone wants very complex setup - sure, they can opt for the VPN solution (even though I don't see that as a simple setup either). But whitelisting home / office IPs is very easy. Dynamic IPs are covered by dynamic dns.

In particular, if we could update such whitelisted IP i.e. via cli (or have a default setting that the current IP of the main Cloudron domain is always whitelisted…)