Protect apps by source IP/domain
-
Hi,
You've added VPN protection to apps. I think it'd be highly useful to additionally have a way to whitelist IPs and domains, which are allowed to access an app (on a per-app basis, similar to VPN protection).
IP whitelisting makes apps protection way easier and less challenging - no need to run VPNs on endpoints or go through a complicated and undocumented process of setting up a VPN tunnel on the edge. No complications with internal network routing on the server. Simple Dynamic DNS setups would allow users with dynamic IPs to continue accessing those apps.
Those wanting to protect their traffic when on open WiFi in public places could either VPN into their home/office/etc. location (which would be whitelisted) or opt for an already existing VPN protection.
Thanks.
PS: I had to go through a lot of pain setting up a VPN tunnel on my OpenWRT router to avoid running VPN clients on all of my devices. But now I have to have a persistent VPN tunnel to my Cloudron, which I don't like one bit. IP whitelisting would be a great solution here. And when I'm away I can always VPN into my OpenWRT router and access protected apps.
-
-
-
This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.
This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.
My (possibly completely wrong) understanding was that this feature request was completely separate to VPN stuff and the idea was that instead on setting up VPN stuff at all you'd be able to simply and easily say "only allow access to this app from this (and internal) specific IP(s)"
-
I am seeing this as a usability issue. Proton VPN (for example) features connection and split-tunneling interfaces that reduce the nitty gritty of manual configuration. Maybe somebody would be willing to build a similar client app (browser extension?) specially designed for Cloudron's VPN?
-
This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.
My (possibly completely wrong) understanding was that this feature request was completely separate to VPN stuff and the idea was that instead on setting up VPN stuff at all you'd be able to simply and easily say "only allow access to this app from this (and internal) specific IP(s)"
This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.
My (possibly completely wrong) understanding was that this feature request was completely separate to VPN stuff and the idea was that instead on setting up VPN stuff at all you'd be able to simply and easily say "only allow access to this app from this (and internal) specific IP(s)"
My understanding is: you enable VPN protection pro forma, and whitelisted IPs can “circumvent” VPN. As a result, no one except whitelisted IPs or those on VPN connections can access the app.
-
The way it's implemented is that the white list is provided in the VPN UI but the VPN itself is optional. It's also not implemented at a per-app level but at a system level just like the current VPN protection.
AFAIU, these IPs are primarily maybe intranet addresses. So, it's a way to say that these IP addresses don't need any protection.
-
@girish Not sure I follow, tbh. My idea is that in addition to the VPN, which has some uses, being able to instead white list IPs / domains on a per-app basis would be very advantageous as well. It makes more sense (to me) to VPN into a location that has been whitelisted to access selected apps, than to VPN into the Cloudron server. Especially if we're talking about multiple users and multiple devices.
-
@girish Not sure I follow, tbh. My idea is that in addition to the VPN, which has some uses, being able to instead white list IPs / domains on a per-app basis would be very advantageous as well. It makes more sense (to me) to VPN into a location that has been whitelisted to access selected apps, than to VPN into the Cloudron server. Especially if we're talking about multiple users and multiple devices.
I may not have understood the feature request then.
being able to instead white list IPs / domains on a per-app basis would be very advantageous as well
What do you mean by whitelist domains? Clients only have an IP address.
It makes more sense (to me) to VPN into a location that has been whitelisted to access selected apps, than to VPN into the Cloudron server
Are you referring to having a set-up where people can VPN into some other external system (say your home router) and that VPN system is whitelisted on Cloudron ?
-
I'm guessing it comes down to allowlisting IP addresses in addition to the internal VPN. Like if I have a VPN on Cloudron A (or an external VPN, proxy or static IP, you name it) and want to access apps that are hidden from public on Cloudron B, I would prefer to do that without switching VPN - by setting those IP addresses as allowed on Cloudron B.
Oh, is that what you already built?
This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.
-
To clear up the confusion, here's my understanding: The new feature would ideally be complementary, not a replacement; both could be combined per app as "allowlisted IPs" or Cloudron VPN.
What's implemented now (as I understand it):
- The allowlist lives in the VPN settings and works system-wide, not per app.
- Its purpose is to let certain addresses (e.g. intranet ranges) skip VPN protection.
- So it's an exception to VPN protection, not an access control mechanism of its own.
What would be nice:
- A per-app IP allowlist that works on its own, with no Cloudron VPN set up or running anywhere.
- It would sit in the app's access settings: "This app is only reachable from the following IPs/CIDRs." Everyone else gets blocked (403 or connection refused).
- Different apps could have different allowlists, or none at all.
Concrete example
- I want to restrict app X to the IP
91.25.XX.XX. - When I connect from a machine whose public IP is
91.25.XX.XX, I get access without any VPN client (Note: this matters because on a company-managed laptop I often can't install or run a VPN client at all). - A client with
91.25.XX.YYgets no access, even though it's in a neighbouring range;93.27.XX.XXgets no access either. - In other words, it's an exact match (
/32) unless I deliberately enter a wider CIDR.
My understanding About "domains":
- I think @bazinga meant a Dynamic DNS hostname (e.g.
myhome.dyndns.example). Cloudron would resolve it periodically and add the resulting IP to the app's allowlist. - That way users with dynamic home IPs can keep their allowlist current without editing it by hand.
About the external VPN scenario:
- If I'm on the road, I VPN into my own router or office, whose public IP is on the allowlist, and reach the app from there.
- That avoids a permanent VPN tunnel to the Cloudron server and avoids running VPN clients on every device.
-
To clear up the confusion, here's my understanding: The new feature would ideally be complementary, not a replacement; both could be combined per app as "allowlisted IPs" or Cloudron VPN.
What's implemented now (as I understand it):
- The allowlist lives in the VPN settings and works system-wide, not per app.
- Its purpose is to let certain addresses (e.g. intranet ranges) skip VPN protection.
- So it's an exception to VPN protection, not an access control mechanism of its own.
What would be nice:
- A per-app IP allowlist that works on its own, with no Cloudron VPN set up or running anywhere.
- It would sit in the app's access settings: "This app is only reachable from the following IPs/CIDRs." Everyone else gets blocked (403 or connection refused).
- Different apps could have different allowlists, or none at all.
Concrete example
- I want to restrict app X to the IP
91.25.XX.XX. - When I connect from a machine whose public IP is
91.25.XX.XX, I get access without any VPN client (Note: this matters because on a company-managed laptop I often can't install or run a VPN client at all). - A client with
91.25.XX.YYgets no access, even though it's in a neighbouring range;93.27.XX.XXgets no access either. - In other words, it's an exact match (
/32) unless I deliberately enter a wider CIDR.
My understanding About "domains":
- I think @bazinga meant a Dynamic DNS hostname (e.g.
myhome.dyndns.example). Cloudron would resolve it periodically and add the resulting IP to the app's allowlist. - That way users with dynamic home IPs can keep their allowlist current without editing it by hand.
About the external VPN scenario:
- If I'm on the road, I VPN into my own router or office, whose public IP is on the allowlist, and reach the app from there.
- That avoids a permanent VPN tunnel to the Cloudron server and avoids running VPN clients on every device.
@msbt yes, that's what has been built.
@necrevistonnezr what you understand is correct. It skips VPN protection for certain addresses.
I think per-app allowlist is entirely possible, we have to see later. At the end of the day, the apps are still protected by their own auth. We had this discussion also for the VPN protection. Should it be global or per-app. How flexible should all this be. Ultimately, for the sake of simplicitly, we went with a single VPN that protects multiple apps.
-
To clear up the confusion, here's my understanding: The new feature would ideally be complementary, not a replacement; both could be combined per app as "allowlisted IPs" or Cloudron VPN.
What's implemented now (as I understand it):
- The allowlist lives in the VPN settings and works system-wide, not per app.
- Its purpose is to let certain addresses (e.g. intranet ranges) skip VPN protection.
- So it's an exception to VPN protection, not an access control mechanism of its own.
What would be nice:
- A per-app IP allowlist that works on its own, with no Cloudron VPN set up or running anywhere.
- It would sit in the app's access settings: "This app is only reachable from the following IPs/CIDRs." Everyone else gets blocked (403 or connection refused).
- Different apps could have different allowlists, or none at all.
Concrete example
- I want to restrict app X to the IP
91.25.XX.XX. - When I connect from a machine whose public IP is
91.25.XX.XX, I get access without any VPN client (Note: this matters because on a company-managed laptop I often can't install or run a VPN client at all). - A client with
91.25.XX.YYgets no access, even though it's in a neighbouring range;93.27.XX.XXgets no access either. - In other words, it's an exact match (
/32) unless I deliberately enter a wider CIDR.
My understanding About "domains":
- I think @bazinga meant a Dynamic DNS hostname (e.g.
myhome.dyndns.example). Cloudron would resolve it periodically and add the resulting IP to the app's allowlist. - That way users with dynamic home IPs can keep their allowlist current without editing it by hand.
About the external VPN scenario:
- If I'm on the road, I VPN into my own router or office, whose public IP is on the allowlist, and reach the app from there.
- That avoids a permanent VPN tunnel to the Cloudron server and avoids running VPN clients on every device.
What would be nice:
A per-app IP allowlist that works on its own, with no Cloudron VPN set up or running anywhere. It would sit in the app's access settings: "This app is only reachable from the following IPs/CIDRs." Everyone else gets blocked (403 or connection refused). Different apps could have different allowlists, or none at all.Yes. And I think that was what this feature request was asking for.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better đź’—
Register Login