starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-26 01:45:54 +03:00

[GH-ISSUE #2130] Global IP/proxyProvider restrictions #1529

New issue

Closed

opened 2026-02-26 07:31:26 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 07:31:26 +03:00

Owner

Originally created by @the-hotmann on GitHub (Jun 27, 2022).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2130

I run mostly all my services on Cloudflare, which is specially helpful, if you want to conceal your origin IP as I run NPM on my NAS and don't want to expose my IP to anyone.

For security reasons, I want to block every request to my NPM that is not proxied through Cloudflare. Since my NAS is getting requests (internally) from my Router I can not simply whitelist my router's IP as it would allow every request again. So I am searching for a way of checking and allowing just requests that are "forwarded for XX" and XX stands for an IP in Cloudflares IP range.

For not blocking my local access to the NPM these infos are required:

routers IP
proxy Service name (Cloudflare)
2.1. Cloudflare's IPs are listed here:
2.1.1. IPv4
2.1.2. IPv6

Now the NPM shall block ALL requests from the router, unless they are within the IP ranges of Cloudflare. Other local requests should be allowed for administration and in case something goes wrong, so local access is not blocked out.

The IPs from Cloudflare shall be updated daily and "tracked". So saving the time when they have been checked last time. so in case something goes wrong we can see/debug it.

It shall be able to set this globally so every other access rule gets extended by this. But for those who want to set it to some domains only shall also be able to do so.

It should be built in a way that in the future other services can easily be added by NPM itself and expert config shall be available, so people can add their very own config/proxyProvider.

Describe the solution you'd like
Just having to provide three infos:

router IP (maybe automatically detectable)
proxyProvider which you want to allow
globally or selected domains

The rest shall be done automatically and it should be hasslefree.
This will guarantee, that just external requests, that hae been proxied by Cloudflare can request anything.

I hope this is not asked for too much, but I think restricting (in a very easy way) who in general is allowed to send requests to you is important for security.

Originally created by @the-hotmann on GitHub (Jun 27, 2022). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2130 I run mostly all my services on Cloudflare, which is specially helpful, if you want to conceal your origin IP as I run NPM on my NAS and don't want to expose my IP to anyone. For security reasons, I want to block every request to my NPM that is not proxied through Cloudflare. Since my NAS is getting requests (internally) from my Router I can not simply whitelist my router's IP as it would allow every request again. So I am searching for a way of checking and allowing just requests that are "forwarded for XX" and XX stands for an IP in Cloudflares IP range. For not blocking my local access to the NPM these infos are required: 1. routers IP 2. proxy Service name (Cloudflare) 2.1. Cloudflare's IPs are listed here: 2.1.1. [IPv4](https://www.cloudflare.com/ips-v4) 2.1.2. [IPv6](https://www.cloudflare.com/ips-v6) Now the NPM shall block ALL requests from the router, unless they are within the IP ranges of Cloudflare. Other local requests should be allowed for administration and in case something goes wrong, so local access is not blocked out. The IPs from Cloudflare shall be updated daily and "tracked". So saving the time when they have been checked last time. so in case something goes wrong we can see/debug it. It shall be able to set this globally so every other access rule gets extended by this. But for those who want to set it to some domains only shall also be able to do so. It should be built in a way that in the future other services can easily be added by NPM itself and expert config shall be available, so people can add their very own config/proxyProvider. **Describe the solution you'd like** Just having to provide three infos: 1. router IP (maybe automatically detectable) 2. proxyProvider which you want to allow 3. globally or selected domains The rest shall be done automatically and it should be hasslefree. This will guarantee, that just external requests, that hae been proxied by Cloudflare can request anything. I hope this is not asked for too much, but I think restricting (in a very easy way) who in general is allowed to send requests to you is important for security.

kerem

2026-02-26 07:31:26 +03:00

closed this issue
added the
enhancement

stale
labels

kerem commented

2026-02-26 07:31:26 +03:00

Author

Owner

@Rustymage commented on GitHub (Jun 28, 2022):

This might help in the meantime https://serverfault.com/questions/601339/how-do-i-deny-all-requests-not-from-cloudflare

@Rustymage commented on GitHub (Jun 28, 2022): This might help in the meantime https://serverfault.com/questions/601339/how-do-i-deny-all-requests-not-from-cloudflare

kerem commented

2026-02-26 07:31:26 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Feb 14, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Feb 14, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 07:31:26 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Mar 30, 2025):

Issue was closed due to inactivity.

@github-actions[bot] commented on GitHub (Mar 30, 2025): Issue was closed due to inactivity.

kerem referenced this issue

2026-02-26 07:33:38 +03:00

[GH-ISSUE #2914] Getting domain_names.map is not a function error in HOSTS #1996

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#1529

No description provided.

Rows
Columns