starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 09:25:55 +03:00

[GH-ISSUE #356] Restricting Access by IP Address #309

New issue

Closed

opened 2026-02-26 06:32:12 +03:00 by kerem · 7 comments

kerem commented

2026-02-26 06:32:12 +03:00

Owner

Originally created by @Indemnity83 on GitHub (Apr 9, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/356

The Problem
I'm using the reverse proxy to give simple domain names to a couple of dozen services all running on docker in my home so I don't have to remember what random port the container's web interface is on. I suspect this use case is quite common (see #137, #135 as similar examples). However, this potentially exposes my proxy hosts to the internet at large, and I don't want public access to these services.

The current Access list will let me put a basic auth "firewall" between the outside world and my private services, but it also complicates access for legitimate access (particularly since password managers can't always fill out basic auth requests, and strong passwords are highly encouraged for anything public).

The Solution
Expand the Access Lists to allow restriction by IP address in addition to basic auth. The NGINX documentation actually has an amazing example that describes exactly what we're after.

I've made a mockup of the revised "New Access List" modal (the HTML can be found in a gist here).

The goal of the UI changes is to keep things simple and approachable even for users who may not understand what's going on under the hood. No other UI changes would be necessary. I'm not certain of the extent of back-end changes required at this point.

Alternatives
This configuration can be achieved by utilizing the advanced -> Custom Nginx Configuration feature already built into the application. However, there are a few issues/concerns with implementing IP restriction this way:

It requires the user to have an understanding of NGINX configuration
Changes/updates must be applied to every proxy host individually
It's not obvious from the proxy hosts list that there is any access control enabled (or conversely if you've forgotten to apply access restrictions to a host)

Originally created by @Indemnity83 on GitHub (Apr 9, 2020). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/356 **The Problem** I'm using the reverse proxy to give simple domain names to a couple of dozen services all running on docker in my home so I don't have to remember what random port the container's web interface is on. I suspect this use case is quite common (see #137, #135 as similar examples). However, this potentially exposes my proxy hosts to the internet at large, and I don't want public access to these services. The current Access list will let me put a basic auth "firewall" between the outside world and my private services, but it also complicates access for legitimate access (particularly since password managers can't always fill out basic auth requests, and strong passwords are highly encouraged for anything public). **The Solution** Expand the Access Lists to allow restriction by IP address in addition to basic auth. The NGINX documentation actually [has an amazing example](https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/#combining-basic-authentication-with-access-restriction-by-ip-address) that describes exactly what we're after. I've made a mockup of the revised "New Access List" modal (the HTML can be found [in a gist here](https://gist.github.com/Indemnity83/12a6a0f34127b79b8200ff43982fe8ce)). ![ezgif com-optimize](https://user-images.githubusercontent.com/35218/78948259-8e4a7880-7a7c-11ea-973a-d5d94dc10726.gif) The goal of the UI changes is to keep things simple and approachable even for users who may not understand what's going on under the hood. No other UI changes would be necessary. I'm not certain of the extent of back-end changes required at this point. **Alternatives** This configuration can be achieved by utilizing the advanced -> Custom Nginx Configuration feature already built into the application. However, there are a few issues/concerns with implementing IP restriction this way: 1. It requires the user to have an understanding of NGINX configuration 2. Changes/updates must be applied to every proxy host individually 3. It's not obvious from the proxy hosts list that there is any access control enabled (or conversely if you've forgotten to apply access restrictions to a host)

kerem

2026-02-26 06:32:12 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-02-26 06:32:12 +03:00

Author

Owner

@Indemnity83 commented on GitHub (Apr 9, 2020):

I'm willing to work on a PR on this as well, but I'm not intimately familiar with the js libraries being used so I may only be able to provide an 80% solution before needing some assistance.

@Indemnity83 commented on GitHub (Apr 9, 2020): I'm willing to work on a PR on this as well, but I'm not intimately familiar with the js libraries being used so I may only be able to provide an 80% solution before needing some assistance.

kerem commented

2026-02-26 06:32:12 +03:00

Author

Owner

@Thijmen commented on GitHub (Apr 11, 2020):

Awesome @Indemnity83 , I was looking for this as well. Is there any way I can help you with? I am not familiar either, but I am sure we can figure it out!

@Thijmen commented on GitHub (Apr 11, 2020): Awesome @Indemnity83 , I was looking for this as well. Is there any way I can help you with? I am not familiar either, but I am sure we can figure it out!

kerem commented

2026-02-26 06:32:12 +03:00

Author

Owner

@Indemnity83 commented on GitHub (Apr 14, 2020):

This was merged in with #360 🎉

@Indemnity83 commented on GitHub (Apr 14, 2020): This was merged in with #360 🎉

kerem commented

2026-02-26 06:32:13 +03:00

Author

Owner

@Yabbo commented on GitHub (Jan 26, 2021):

this doesnt seam to actually stop anything for me... if I put allow a specific internal ip and leave the block all at the end i can still hit the domain from outside my network.

@Yabbo commented on GitHub (Jan 26, 2021): this doesnt seam to actually stop anything for me... if I put allow a specific internal ip and leave the block all at the end i can still hit the domain from outside my network.

kerem commented

2026-02-26 06:32:13 +03:00

Author

Owner

@talesam commented on GitHub (Mar 25, 2021):

Can I restrict that a host can only be accessed by a specific IP? I want to restrict only one hots, where is my served as bkp running with web interface.

@talesam commented on GitHub (Mar 25, 2021): Can I restrict that a host can only be accessed by a specific IP? I want to restrict only one hots, where is my served as bkp running with web interface.

kerem commented

2026-02-26 06:32:13 +03:00

Author

Owner

@Subline-75 commented on GitHub (May 11, 2021):

this doesnt seam to actually stop anything for me... if I put allow a specific internal ip and leave the block all at the end i can still hit the domain from outside my network.

Did you find a way to block access via the server ip?
I can access the auth page of NPM via my domain but also with my serverip and I would like to prevent this.

@Subline-75 commented on GitHub (May 11, 2021): > this doesnt seam to actually stop anything for me... if I put allow a specific internal ip and leave the block all at the end i can still hit the domain from outside my network. Did you find a way to block access via the server ip? I can access the auth page of NPM via my domain but also with my serverip and I would like to prevent this.

kerem commented

2026-02-26 06:32:13 +03:00

Author

Owner

@l-Legacy-l commented on GitHub (May 13, 2021):

It doesn't seem to work for me also

@l-Legacy-l commented on GitHub (May 13, 2021): It doesn't seem to work for me also

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#309

No description provided.

Rows
Columns