[GH-ISSUE #3002] Unable to set access control lists based on IP/network

kerem commented

2026-02-26 07:33:49 +03:00

Owner

Originally created by @crosesvg on GitHub (Jun 16, 2023).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3002

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug
Access lists do not work as all connections are seen to originate from the containers gateway address

Nginx Proxy Manager Version
v2.10.3

To Reproduce
Steps to reproduce the behavior:
Configure an Access list to:
allow traffic from local networks (e.g. 192.168.0.0/16)
Deny traffic from all
Assign the access list to a proxy host
Attempt to access the proxy host

Expected behavior
Traffic originating from 192.168.0.0/16 networks are granted access
Traffic originating from other internal/external networks are denied

Actual behavior
Traffic from 192.168.0.0/16 networks are denied access
if the access list is updated to include 172.16.0.0/16 (e.g. the subnet/ip address of the docker container/gateway) then connections are allowed from all networks (as all requests are seen to originate from the subnet that the container/gateway resides in)

Operating System
Docker desktop/WSL on Windows

Originally created by @crosesvg on GitHub (Jun 16, 2023). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3002 **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes Describe the bug Access lists do not work as all connections are seen to originate from the containers gateway address Nginx Proxy Manager Version v2.10.3 **To Reproduce** Steps to reproduce the behavior: Configure an Access list to: allow traffic from local networks (e.g. 192.168.0.0/16) Deny traffic from all Assign the access list to a proxy host Attempt to access the proxy host **Expected behavior** Traffic originating from 192.168.0.0/16 networks are granted access Traffic originating from other internal/external networks are denied **Actual behavior** Traffic from 192.168.0.0/16 networks are denied access if the access list is updated to include 172.16.0.0/16 (e.g. the subnet/ip address of the docker container/gateway) then connections are allowed from all networks (as all requests are seen to originate from the subnet that the container/gateway resides in) **Operating System** Docker desktop/WSL on Windows

kerem added the

stale

bug

labels

2026-02-26 07:33:49 +03:00

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@jmaximusix commented on GitHub (Sep 2, 2023):

can confirm
This reddit user has also come to the same conclusion:
https://www.reddit.com/r/nginxproxymanager/comments/110634p/comment/j8lc9cj/?utm_source=share&utm_medium=web2x&context=3

@jmaximusix commented on GitHub (Sep 2, 2023): can confirm This reddit user has also come to the same conclusion: https://www.reddit.com/r/nginxproxymanager/comments/110634p/comment/j8lc9cj/?utm_source=share&utm_medium=web2x&context=3

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@grainsoflight commented on GitHub (Sep 29, 2023):

Having the same issue. adding

location = / {
allow 192.168.0.0/24;
deny all;
}

manually to the advanced settings resolves the issue, so it seems like the access lists arent properly inserting it

@grainsoflight commented on GitHub (Sep 29, 2023): Having the same issue. adding location = / { allow 192.168.0.0/24; deny all; } manually to the advanced settings resolves the issue, so it seems like the access lists arent properly inserting it

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@dezza commented on GitHub (Oct 22, 2023):

Try to check(box) "Satisfy any" [x]

I had issues with HTTP Basic Auth as well, but this made sure it satisfied on IP-restrictions only.

@dezza commented on GitHub (Oct 22, 2023): Try to check(box) "Satisfy any" [x] I had issues with HTTP Basic Auth as well, but this made sure it satisfied on IP-restrictions only.

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@grainsoflight commented on GitHub (Oct 22, 2023):

I had tried this and it did not work

On Sat, Oct 21, 2023, 11:53 PM dezza @.***> wrote:

Try to check(box) "Satisfy any" [x]

I had issues with HTTP Basic Auth as well, but this made sure it satisfied
on IP-restrictions only.

—
Reply to this email directly, view it on GitHub
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3002#issuecomment-1773985765,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AHANMY2IR2VIQUEZA6LRINTYASKB5AVCNFSM6AAAAAAZJEBKEKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONZTHE4DKNZWGU
.
You are receiving this because you commented.Message ID:
@.***>

@grainsoflight commented on GitHub (Oct 22, 2023): I had tried this and it did not work On Sat, Oct 21, 2023, 11:53 PM dezza ***@***.***> wrote: > Try to check(box) "Satisfy any" [x] > > I had issues with HTTP Basic Auth as well, but this made sure it satisfied > on IP-restrictions only. > > — > Reply to this email directly, view it on GitHub > <https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3002#issuecomment-1773985765>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AHANMY2IR2VIQUEZA6LRINTYASKB5AVCNFSM6AAAAAAZJEBKEKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONZTHE4DKNZWGU> > . > You are receiving this because you commented.Message ID: > ***@***.***> >

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@dezza commented on GitHub (Oct 22, 2023):

I had tried this and it did not work

Ok! Well maybe try with a new entry so you're sure a new file is being created.

I couldn't get the basic auth working, not sure why, it showed my user and an excerpt (3 letters or so) of the password for login, but this login never worked in basic auth, so not sure what was wrong..

@dezza commented on GitHub (Oct 22, 2023): > I had tried this and it did not work Ok! Well maybe try with a new entry so you're sure a new file is being created. I couldn't get the basic auth working, not sure why, it showed my user and an excerpt (3 letters or so) of the password for login, but this login never worked in basic auth, so not sure what was wrong..

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@dezza commented on GitHub (Oct 23, 2023):

Btw the issue with not seeing the correct source IP is easily resolved by running the container with --network=slirp4netns:port_handler=slirp4netns

@dezza commented on GitHub (Oct 23, 2023): Btw the issue with not seeing the correct source IP is easily resolved by running the container with `--network=slirp4netns:port_handler=slirp4netns`

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jun 4, 2024):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Jun 4, 2024): Issue is now considered stale. If you want to keep it open, please comment :+1:

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@luixal commented on GitHub (Dec 14, 2024):

Just got here as I'm still having this issue.

Any workaround other than @grainsoflight ? Works like a charm but it's hard to keep track of which domains have which access...

@luixal commented on GitHub (Dec 14, 2024): Just got here as I'm still having this issue. Any workaround other than @grainsoflight ? Works like a charm but it's hard to keep track of which domains have which access...

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@smileatom commented on GitHub (Jan 3, 2025):

The reason the ACLs dont work is that NGINX in docker has no idea what the source IP of the request is, it thinks its the IP of the docker container. Therefore it cannot work.

@smileatom commented on GitHub (Jan 3, 2025): The reason the ACLs dont work is that NGINX in docker has no idea what the source IP of the request is, it thinks its the IP of the docker container. Therefore it cannot work.

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@luixal commented on GitHub (Jan 4, 2025):

Then, why does it work by adding it manually like in the example above? I tried it myself and it does work for me.

@luixal commented on GitHub (Jan 4, 2025): Then, why does it work by adding it manually like in the example above? I tried it myself and it does work for me.

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@smileatom commented on GitHub (Jan 5, 2025):

Then, why does it work by adding it manually like in the example above? I tried it myself and it does work for me.

Becxause you likely added a CIDR block that includes the docker container IP.

@smileatom commented on GitHub (Jan 5, 2025): > Then, why does it work by adding it manually like in the example above? I tried it myself and it does work for me. Becxause you likely added a CIDR block that includes the docker container IP.

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@luixal commented on GitHub (Jan 5, 2025):

I don't think I've added anything else, but can't be sure as I set it up long time ago.

Will try deploying this in a linux container instead of a docker one. That should fix it is that's the issue.

@luixal commented on GitHub (Jan 5, 2025): I don't think I've added anything else, but can't be sure as I set it up long time ago. Will try deploying this in a linux container instead of a docker one. That should fix it is that's the issue.

kerem commented

2026-02-26 07:33:50 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jul 12, 2025):

Issue is now considered stale. If you want to keep it open, please comment 👍

@github-actions[bot] commented on GitHub (Jul 12, 2025): Issue is now considered stale. If you want to keep it open, please comment :+1:

Rows
Columns

[GH-ISSUE #3002] Unable to set access control lists based on IP/network #2049