We already run a company VPN. For certain Cloudron apps (admin tools, internal services, staging, etc.) we would like to restrict access so they are only reachable from our existing company network / VPN ranges.
The current VPN Protection feature solves a similar problem, but it requires users to connect to Cloudron’s own VPN app. For organizations that already have a VPN or a well-defined internal network, this means running and managing a second VPN just for Cloudron apps, which is unnecessary overhead.
Proposed feature:
Add a per-app setting (similar to “Require VPN”) that allows defining one or more allowed IP ranges (CIDR). Requests from outside these ranges are rejected (e.g. with a 403 or a simple “Access restricted” page).
Example use cases:
- App only reachable from the company VPN / office LAN
- Different apps with different allowlists (public website vs. internal tools)
- No need for an additional VPN client when the user is already inside the company network
Why this is better than only VPN Protection in our case:
- We already have a VPN. Forcing Cloudron’s VPN on top creates friction and support load.
- Source IPs are known and stable when users come through the company VPN.
- Simple CIDR allowlist is easy to understand and configure for admins.
Technically this should be straightforward to implement in the existing reverse-proxy config generation (Nginx allow / deny per app server block), similar to how VPN Protection already injects rules.
Would be happy to help test if this gets implemented.
