Protect apps by source IP/domain

[bazinga]

Hi,

You've added VPN protection to apps. I think it'd be highly useful to additionally have a way to whitelist IPs and domains, which are allowed to access an app (on a per-app basis, similar to VPN protection).

IP whitelisting makes apps protection way easier and less challenging - no need to run VPNs on endpoints or go through a complicated and undocumented process of setting up a VPN tunnel on the edge. No complications with internal network routing on the server. Simple Dynamic DNS setups would allow users with dynamic IPs to continue accessing those apps.

Those wanting to protect their traffic when on open WiFi in public places could either VPN into their home/office/etc. location (which would be whitelisted) or opt for an already existing VPN protection.

Thanks.

PS: I had to go through a lot of pain setting up a VPN tunnel on my OpenWRT router to avoid running VPN clients on all of my devices. But now I have to have a persistent VPN tunnel to my Cloudron, which I don't like one bit. IP whitelisting would be a great solution here. And when I'm away I can always VPN into my OpenWRT router and access protected apps.

[robi]

This would be fairly easy if taking cues from all dashboard login IPs and updating the nginx allow list for all apps that are protected.

[girish]

This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.

[jdaviescoates]

@girish said:

This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.

My (possibly completely wrong) understanding was that this feature request was completely separate to VPN stuff and the idea was that instead on setting up VPN stuff at all you'd be able to simply and easily say "only allow access to this app from this (and internal) specific IP(s)"

[jdbaker]

I am seeing this as a usability issue. Proton VPN (for example) features connection and split-tunneling interfaces that reduce the nitty gritty of manual configuration. Maybe somebody would be willing to build a similar client app (browser extension?) specially designed for Cloudron's VPN?

[necrevistonnezr]

@jdaviescoates said:

@girish said:

This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.

My (possibly completely wrong) understanding was that this feature request was completely separate to VPN stuff and the idea was that instead on setting up VPN stuff at all you'd be able to simply and easily say "only allow access to this app from this (and internal) specific IP(s)"

My understanding is: you enable VPN protection pro forma, and whitelisted IPs can “circumvent” VPN. As a result, no one except whitelisted IPs or those on VPN connections can access the app.

[girish]

The way it's implemented is that the white list is provided in the VPN UI but the VPN itself is optional. It's also not implemented at a per-app level but at a system level just like the current VPN protection.

AFAIU, these IPs are primarily maybe intranet addresses. So, it's a way to say that these IP addresses don't need any protection.