Protect apps by source IP/domain

[jdbaker]

I am seeing this as a usability issue. Proton VPN (for example) features connection and split-tunneling interfaces that reduce the nitty gritty of manual configuration. Maybe somebody would be willing to build a similar client app (browser extension?) specially designed for Cloudron's VPN?

[necrevistonnezr]

@jdaviescoates said:

@girish said:

This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.

My (possibly completely wrong) understanding was that this feature request was completely separate to VPN stuff and the idea was that instead on setting up VPN stuff at all you'd be able to simply and easily say "only allow access to this app from this (and internal) specific IP(s)"

My understanding is: you enable VPN protection pro forma, and whitelisted IPs can “circumvent” VPN. As a result, no one except whitelisted IPs or those on VPN connections can access the app.

[girish]

The way it's implemented is that the white list is provided in the VPN UI but the VPN itself is optional. It's also not implemented at a per-app level but at a system level just like the current VPN protection.

AFAIU, these IPs are primarily maybe intranet addresses. So, it's a way to say that these IP addresses don't need any protection.

[bazinga]

@girish Not sure I follow, tbh. My idea is that in addition to the VPN, which has some uses, being able to instead white list IPs / domains on a per-app basis would be very advantageous as well. It makes more sense (to me) to VPN into a location that has been whitelisted to access selected apps, than to VPN into the Cloudron server. Especially if we're talking about multiple users and multiple devices.

[girish]

I may not have understood the feature request then.

@bazinga said:

being able to instead white list IPs / domains on a per-app basis would be very advantageous as well

What do you mean by whitelist domains? Clients only have an IP address.

It makes more sense (to me) to VPN into a location that has been whitelisted to access selected apps, than to VPN into the Cloudron server

Are you referring to having a set-up where people can VPN into some other external system (say your home router) and that VPN system is whitelisted on Cloudron ?

[msbt]

I'm guessing it comes down to allowlisting IP addresses in addition to the internal VPN. Like if I have a VPN on Cloudron A (or an external VPN, proxy or static IP, you name it) and want to access apps that are hidden from public on Cloudron B, I would prefer to do that without switching VPN - by setting those IP addresses as allowed on Cloudron B.

Oh, is that what you already built?

This is implemented now. You can add a allow list block of addresses (IPs or CIDRs) to bypass the VPN.

[necrevistonnezr]

To clear up the confusion, here's my understanding: The new feature would ideally be complementary, not a replacement; both could be combined per app as "allowlisted IPs" or Cloudron VPN.

What's implemented now (as I understand it):

• The allowlist lives in the VPN settings and works system-wide, not per app.
• Its purpose is to let certain addresses (e.g. intranet ranges) skip VPN protection.
• So it's an exception to VPN protection, not an access control mechanism of its own.

What would be nice:

• A per-app IP allowlist that works on its own, with no Cloudron VPN set up or running anywhere.
• It would sit in the app's access settings: "This app is only reachable from the following IPs/CIDRs." Everyone else gets blocked (403 or connection refused).
• Different apps could have different allowlists, or none at all.

Concrete example

• I want to restrict app X to the IP 91.25.XX.XX.
• When I connect from a machine whose public IP is 91.25.XX.XX, I get access without any VPN client (Note: this matters because on a company-managed laptop I often can't install or run a VPN client at all).
• A client with 91.25.XX.YY gets no access, even though it's in a neighbouring range; 93.27.XX.XX gets no access either.
• In other words, it's an exact match (/32) unless I deliberately enter a wider CIDR.

My understanding About "domains":

• I think @bazinga meant a Dynamic DNS hostname (e.g. myhome.dyndns.example). Cloudron would resolve it periodically and add the resulting IP to the app's allowlist.
• That way users with dynamic home IPs can keep their allowlist current without editing it by hand.

About the external VPN scenario:

• If I'm on the road, I VPN into my own router or office, whose public IP is on the allowlist, and reach the app from there.
• That avoids a permanent VPN tunnel to the Cloudron server and avoids running VPN clients on every device.

[girish]

@msbt yes, that's what has been built.

@necrevistonnezr what you understand is correct. It skips VPN protection for certain addresses.

I think per-app allowlist is entirely possible, we have to see later. At the end of the day, the apps are still protected by their own auth. We had this discussion also for the VPN protection. Should it be global or per-app. How flexible should all this be. Ultimately, for the sake of simplicitly, we went with a single VPN that protects multiple apps.

[jdaviescoates]

@necrevistonnezr said:

What would be nice:

A per-app IP allowlist that works on its own, with no Cloudron VPN set up or running anywhere.
It would sit in the app's access settings: "This app is only reachable from the following IPs/CIDRs." Everyone else gets blocked (403 or connection refused).
Different apps could have different allowlists, or none at all.

Yes. And I think that was what this feature request was asking for.

[bazinga]

@necrevistonnezr Thank you for re-phrasing and re-stating. Yes, you've covered pretty much everything I've proposed.