Added support for ddns lookups for addresses in access lists #3364
Conversation
|
Update the CI build is working. The easiest way to test/use the changes is to use E.g. in your docker compose file, replace: Manual instructions (no longer needed, but kept in case the above image does not work).You can test the changes in this PR by doing the following:
volumes:
# Add these
- your-data-path/index.js:/app/index.js
- your-data-path/logger.js:/app/logger.js
- your-data-path/nginx.js:/app/internal/nginx.js
- your-data-path/access-lists.json:/app/schema/endpoints/access-lists.json
- your-data-path/utils.js:/app/lib/utils.js
- your-data-path/ddns_resolver/ddns_resolver.js:/app/lib/ddns_resolver/ddns_resolver.js
- your-data-path/ddns_resolver/ddns_updater.js:/app/lib/ddns_resolver/ddns_updater.js
|
vari
force-pushed
the
access-list-client-ddns-support
branch
2 times, most recently
from
51f7715 to
dd8ded7
Compare
|
Hello, Is it possible for the NPM build to be updated to the latest version? Is your change expected to be added to the final version of NPM? Is it possible to add a block by country? Is it possible to add the use of FQDN for list access and not necessarily DDNS. Thanks for you job :) |
|
an update ? I just detected a bug, we can use an fqdn after "ddns:" it should work, the problem is that for a ddns entry or whatever we can't have a "-" in the name, like "ddns:example-ddns.com" doesn't work Thanks for your job ! |
This is a first pass attempt at adding support for using ddns (really any resolvable domain name) as the address in access list clients. This helps make it possible to restrict access to hosts using a dynamic public IP (e.g. allow access to a proxied host from your local network only via ddns address). Current approach is hacky since it was developed by manually replacing files in an existing npm docker container. Future commits will integrate this better and avoid needing to patch/intercept existing APIs. See associated PR for more details.
Refactored ddns resolver so that no patching is done. nginx.js will automatically resolve ddns addresses if needed. Added dedicated logger scope for ddns resovler.
Other changes: - Fixed null property read error on clients (when switching to public access) - Use separate `resolvedAddress` field for resolved IP instead of overwriting address - Reduced ddns log verbosity
vari
force-pushed
the
access-list-client-ddns-support
branch
from
bae32ee to
e317900
Compare
I no longer use this but the fix to support |
|
Docker Image for build 8 is available on DockerHub as Note: ensure you backup your NPM instance before testing this PR image! Especially if this PR contains database changes. |
|
Is this ready to merge? I'd love to use this feature. Thanks. |
|
Hi All, just found this PR - exactly what I was looking for so I am testing it now. I can reboot my router to get a new IP address out of working hours to test the change of IP address. Are there any logs/ checks that would be useful when I run the test? Thanks for the code. I did look at doing something myself, but js is not my thing, so happy to be a tester, |
|
It worked in the described way. Log shows: The hosts configured using the access list which is dynamic IP address only, are now accessible. Those hosts did appear as 403 forbidden between the times of the IP address change and the processing above. My DDNS hostname does not have a hyphen. For the record I used image 'jc21/nginx-proxy-manager:github-pr-3364', downloaded 19th July 2024. The DDNS update runs every hour. I would prefer a quicker response; can I suggest checking every 15 minutes. Other than that, it all works great, so I think it is ready to merge into the next release. Thanks again to those who have worked on this PR. |
How to change DDNS update intervalAfter a little digging in the code, I saw a comment that the So please ignore my comment above, it is configurable in docker. It just ran after 15 minutes, so this override is working. To help others change the interval in the future, see the line starting DDNS_UPDATE_INTERVAL in my docker-compose.yml below (passwords obscured): |
|
Glad to see that this is helping folks. In terms of merging it into the main project, I'd love to but whether or not this gets merged is up to the maintainers. As you can, see there are currently 50+ open PRs (many of which are older than this one) so I wouldn't hold out hope of this being merged anytime soon. The best option in the meantime is to continue to use the PR branch image ( |
Hello, Thanks for your support. I just tried, we no longer have an error when we configure a ddns entry with one or several - in the host name but after several cross tests, the access does not work behind. Are your changes expected to be integrated into NPM? Can you update your merge with the last NPM release ? edit : I have try to pull the last docker images and now the ddns wasn't working :/ Thanks again ! |
|
I made #4386 address merge conflicts, if you'd like to use these changes, you can use the build from that PR |
|
Hello, |
We should convince the maintainer @jc21 to do that |
Added support for
ddns:somedomain.whateverddns.comaddress format in the client access lists.This allows users to specify domain names instead of IP addresses for allow/deny lists, thereby allowing dynamic allow/deny lists.
This is useful if users have a service exposed to the public internet via a ddns domain, and they want to limit it so that only users from the local network can access the service on the ddns domain.
In theory, this is probably already possible by using custom DNS server to prevent any local network request to the domain name from going outside to the internet (and then setting allow list to local subnet in proxy manager), but not everyone can (or will) use a custom DNS server for their setup.
The new ddns support makes it trivially easy for anyone to limit to local network if they are using ddns without having to mess with custom DNS servers or network configuration. Also, if users want to expose their service to a fixed number of external users, then the ddns lookup can be used with the allow list provided the external users are using a ddns service. E.g. if I want to share a service on my network to 2 friends, and each friend uses a ddns that points to their public IP (friend1.domain.com, friend2.domain.com), then I can just add
ddns:friend1.domain.comandddns:friend2.domain.comto my allow list in proxy manager and they will continue to have access even if their public IP changes. I won't have to manually go an update the access list every time the IP changes.This should address #1708 and #2240 .
Compared to some of the existing solutions mentioned in the above issues, this implementation should be the simplest with minimal overhead and no other dependencies (e.g. no cron, env vars, etc needed). Can directly specify the domains in the normal allow list UI.
Usage:
ddns:e.g. If you want to add the dynamic hosts
yourdomain.ddns.comandyourdomain2.ddns.comto your allow list, do the following:DDNS_UPDATE_INTERVALenv var to the desired number of seconds (minimum 60).On start up, all used domains will be resolved and any associated hosts will be updated in nginx about 10s after the proxy manager starts (10s buffer ensures server has enough time to finish loading).
Disclaimers:
getent hosts <hostname>to look up the IP of the user defined domains - if there is a better way, please let me know and I can update the PR. I've tried to make it safe by using spawn instead of exec to prevent issues with unsanitized user inputs, however I'm not doing any custom sanitization.