[PR #4386] Added support for ddns lookups for addresses in access lists (resolved merge conflicts from #3364) #3875

New issue

Open

opened 2026-02-26 08:32:17 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 08:32:17 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4386
Author: @sylphrena0
Created: 2/22/2025
Status: 🔄 Open

Base: develop ← Head: develop

📝 Commits (10+)

5586709 Initial pass at DDNS support for client addresses
ec9eb0d Refactor and integrate ddns resolution with nginx module
972d158 fix linter warnings
33f41f7 Fix utils.js linter error
743cdd8 Eliminate circular dependency
7b09fef Update configs for active hosts only on ddns update
3b0ff57 doc string update
e317900 Add support for '-' in ddns domain names
6033b30 Merge remote-tracking branch 'origin-ddns/access-list-client-ddns-support' into develop
cae8ba9 add ddns field to new json files

📊 Changes

11 files changed (+360 additions, -16 deletions)

View changed files

📝 backend/index.js (+2 -0)
📝 backend/internal/access-list.js (+10 -0)
📝 backend/internal/nginx.js (+49 -9)
➕ backend/lib/ddns_resolver/ddns_resolver.js (+70 -0)
➕ backend/lib/ddns_resolver/ddns_updater.js (+170 -0)
📝 backend/lib/utils.js (+35 -0)
📝 backend/logger.js (+2 -1)
📝 backend/schema/components/access-list-object.json (+6 -2)
📝 backend/schema/paths/nginx/access-lists/listID/put.json (+6 -2)
📝 backend/schema/paths/nginx/access-lists/post.json (+6 -2)
📝 frontend/js/app/nginx/access/form.ejs (+4 -0)

📄 Description

Added support for ddns:somedomain.whateverddns.com address format in the client access lists.

This allows users to specify domain names instead of IP addresses for allow/deny lists, thereby allowing dynamic allow/deny lists.

This is useful if users have a service exposed to the public internet via a ddns domain, and they want to limit it so that only users from the local network can access the service on the ddns domain.

In theory, this is probably already possible by using custom DNS server to prevent any local network request to the domain name from going outside to the internet (and then setting allow list to local subnet in proxy manager), but not everyone can (or will) use a custom DNS server for their setup.

The new ddns support makes it trivially easy for anyone to limit to local network if they are using ddns without having to mess with custom DNS servers or network configuration. Also, if users want to expose their service to a fixed number of external users, then the ddns lookup can be used with the allow list provided the external users are using a ddns service. E.g. if I want to share a service on my network to 2 friends, and each friend uses a ddns that points to their public IP (friend1.domain.com, friend2.domain.com), then I can just add ddns:friend1.domain.com and ddns:friend2.domain.com to my allow list in proxy manager and they will continue to have access even if their public IP changes. I won't have to manually go an update the access list every time the IP changes.

This should address #1708 and #2240 .

Compared to some of the existing solutions mentioned in the above issues, this implementation should be the simplest with minimal overhead and no other dependencies (e.g. no cron, env vars, etc needed). Can directly specify the domains in the normal allow list UI.

Usage:
* Prefix the dynamic domain/host you want to use for the access list with `ddns:`
  e.g. If you want to add the dynamic hosts `yourdomain.ddns.com` and `yourdomain2.ddns.com` to your allow list, do the following:
  ![image](https://private-user-images.githubusercontent.com/651665/287489951-7c3327c8-ed4d-4a35-a768-7e8b96b63877.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NDAyNjY5MjksIm5iZiI6MTc0MDI2NjYyOSwicGF0aCI6Ii82NTE2NjUvMjg3NDg5OTUxLTdjMzMyN2M4LWVkNGQtNGEzNS1hNzY4LTdlOGI5NmI2Mzg3Ny5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjUwMjIyJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI1MDIyMlQyMzIzNDlaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1iZjVjZGIxODA5ODllMTFkODk2M2VhNzAwMmU2M2YxYTg2ZDUzMTlkMTFhNjBjYTM4ZGI4OGFhMGUwMDk1NDljJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCJ9.aQFhRTrblpBwKkF901gYgL545SbkPZsYXBgctF_uwcA)

* Upon saving the access list, any associated hosts will automatically be updated to use the resolved IP of the dynamic domain/host in the access list (and this will trigger a nginx reload so that changes take effect).

* The proxy manager will also periodically poll the dynamic domains, and update any proxy hosts that are using those domains if there is an IP address update. Default interval is 1 hour, can be configured by setting the `DDNS_UPDATE_INTERVAL` env var to the desired number of seconds (minimum 60).
  On start up, all used domains will be resolved and any associated hosts will be updated in nginx about 10s after the proxy manager starts (10s buffer ensures server has enough time to finish loading).
Disclaimers:
* I haven't used js in almost 6 years, do not be surprised if the code is inefficient / not following best practices. Suggestions for cleaning up and refactoring the code to make it more efficient/readable are welcome!

* I'm using `getent hosts <hostname>` to look up the IP of the user defined domains - if there is a better way, please let me know and I can update the PR. I've tried to make it safe by using spawn instead of exec to prevent issues with unsanitized user inputs, however I'm not doing any custom sanitization.

Resolves conflicts from @vari's #3364 with a merge commit.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4386 **Author:** [@sylphrena0](https://github.com/sylphrena0) **Created:** 2/22/2025 **Status:** 🔄 Open **Base:** `develop` ← **Head:** `develop` --- ### 📝 Commits (10+) - [`5586709`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/5586709d03b077c795b65511785154b4ce12022b) Initial pass at DDNS support for client addresses - [`ec9eb0d`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/ec9eb0dd6078ad3e892bac5437f30c723f5b0982) Refactor and integrate ddns resolution with nginx module - [`972d158`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/972d158161654481bd36532626b1e395fa19b559) fix linter warnings - [`33f41f7`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/33f41f7e6ff5bd52a445147a0956f280308f1fd3) Fix utils.js linter error - [`743cdd8`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/743cdd8b0be23923c2f7a2f039aa5b02f2dd0351) Eliminate circular dependency - [`7b09fef`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/7b09fefd1799be082e0c140e446a6ee260719333) Update configs for active hosts only on ddns update - [`3b0ff57`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/3b0ff570d9b948eb3503075cf92437c063e42c3d) doc string update - [`e317900`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/e3179006d1f186a50794137ece08b7495a28e7a3) Add support for '-' in ddns domain names - [`6033b30`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/6033b3039d5ebbf81d4faca99029ee88eddafc51) Merge remote-tracking branch 'origin-ddns/access-list-client-ddns-support' into develop - [`cae8ba9`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/cae8ba9fd43547e0857cc601b84e900080cc0788) add ddns field to new json files ### 📊 Changes **11 files changed** (+360 additions, -16 deletions) <details> <summary>View changed files</summary> 📝 `backend/index.js` (+2 -0) 📝 `backend/internal/access-list.js` (+10 -0) 📝 `backend/internal/nginx.js` (+49 -9) ➕ `backend/lib/ddns_resolver/ddns_resolver.js` (+70 -0) ➕ `backend/lib/ddns_resolver/ddns_updater.js` (+170 -0) 📝 `backend/lib/utils.js` (+35 -0) 📝 `backend/logger.js` (+2 -1) 📝 `backend/schema/components/access-list-object.json` (+6 -2) 📝 `backend/schema/paths/nginx/access-lists/listID/put.json` (+6 -2) 📝 `backend/schema/paths/nginx/access-lists/post.json` (+6 -2) 📝 `frontend/js/app/nginx/access/form.ejs` (+4 -0) </details> ### 📄 Description > Added support for `ddns:somedomain.whateverddns.com` address format in the client access lists. > > This allows users to specify domain names instead of IP addresses for allow/deny lists, thereby allowing dynamic allow/deny lists. > > This is useful if users have a service exposed to the public internet via a ddns domain, and they want to limit it so that only users from the local network can access the service on the ddns domain. > > In theory, this is probably already possible by using custom DNS server to prevent any local network request to the domain name from going outside to the internet (and then setting allow list to local subnet in proxy manager), but not everyone can (or will) use a custom DNS server for their setup. > > The new ddns support makes it trivially easy for anyone to limit to local network if they are using ddns without having to mess with custom DNS servers or network configuration. Also, if users want to expose their service to a fixed number of external users, then the ddns lookup can be used with the allow list provided the external users are using a ddns service. E.g. if I want to share a service on my network to 2 friends, and each friend uses a ddns that points to their public IP (friend1.domain.com, friend2.domain.com), then I can just add `ddns:friend1.domain.com` and `ddns:friend2.domain.com` to my allow list in proxy manager and they will continue to have access even if their public IP changes. I won't have to manually go an update the access list every time the IP changes. > > This should address #1708 and #2240 . > > Compared to some of the existing solutions mentioned in the above issues, this implementation should be the simplest with minimal overhead and no other dependencies (e.g. no cron, env vars, etc needed). Can directly specify the domains in the normal allow list UI. > > Usage: > > * Prefix the dynamic domain/host you want to use for the access list with `ddns:` > e.g. If you want to add the dynamic hosts `yourdomain.ddns.com` and `yourdomain2.ddns.com` to your allow list, do the following: > ![image](https://private-user-images.githubusercontent.com/651665/287489951-7c3327c8-ed4d-4a35-a768-7e8b96b63877.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NDAyNjY5MjksIm5iZiI6MTc0MDI2NjYyOSwicGF0aCI6Ii82NTE2NjUvMjg3NDg5OTUxLTdjMzMyN2M4LWVkNGQtNGEzNS1hNzY4LTdlOGI5NmI2Mzg3Ny5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjUwMjIyJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI1MDIyMlQyMzIzNDlaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1iZjVjZGIxODA5ODllMTFkODk2M2VhNzAwMmU2M2YxYTg2ZDUzMTlkMTFhNjBjYTM4ZGI4OGFhMGUwMDk1NDljJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCJ9.aQFhRTrblpBwKkF901gYgL545SbkPZsYXBgctF_uwcA) > > * Upon saving the access list, any associated hosts will automatically be updated to use the resolved IP of the dynamic domain/host in the access list (and this will trigger a nginx reload so that changes take effect). > > * The proxy manager will also periodically poll the dynamic domains, and update any proxy hosts that are using those domains if there is an IP address update. Default interval is 1 hour, can be configured by setting the `DDNS_UPDATE_INTERVAL` env var to the desired number of seconds (minimum 60). > On start up, all used domains will be resolved and any associated hosts will be updated in nginx about 10s after the proxy manager starts (10s buffer ensures server has enough time to finish loading). > > > Disclaimers: > > * I haven't used js in almost 6 years, do not be surprised if the code is inefficient / not following best practices. Suggestions for cleaning up and refactoring the code to make it more efficient/readable are welcome! > > * I'm using `getent hosts <hostname>` to look up the IP of the user defined domains - if there is a better way, please let me know and I can update the PR. I've tried to make it safe by using spawn instead of exec to prevent issues with unsanitized user inputs, however I'm not doing any custom sanitization. Resolves conflicts from @vari's #3364 with a merge commit. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem added the

pull-request

label

2026-02-26 08:32:17 +03:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#3875

No description provided.

Rows
Columns