search

NginxProxyManager / nginx-proxy-manager

Docker container for managing Nginx proxy hosts with a simple, powerful interface
https://nginxproxymanager.com
MIT License
22.25k stars 2.57k forks source link

Access list restrictions not preventing access through ipv6 #3011

Open moutasem1989 opened 1 year ago

moutasem1989 commented 1 year ago

Checklist

Describe the bug On the server services are accessed through Nginx but restricted to certain IPv4 subnets with Access Lists. When useing Domain AAAA record with IPv4, Nginx behaves as expected and restricts access accordingly. When useing Domain AAAA record with IPv6, all servicess can be accessed from outside the Subnet restriction list. An example service was restricted to local network Subnet. Using a device outside the network, i was able to access it. on the other hand, when activating VPN, the service is again restricted. the fact it was accessible at all is concerning.

Edit: I also tried restricting the Service by adding fe80::/10 to limit access to Link-Local Unicast (Same switch). No success.. Service can still be accessed.

Nginx Proxy Manager Version v2.10.3

To Reproduce Steps to reproduce the behavior:

  1. create a service with restricted access to local network; for example 192.168.0.0/24.
  2. create a AAAA domain record with the IPv6 of the server.
  3. test if the service is accessble through the assigned Domain outside the network.

Expected behavior since there are no IPv6/Subnet specified in the Access List and only Local Network IPv4/Subnet is provided, access should be denied if the device is not on the local network.

Operating System Nginx on Docker Engine 24.0.2; Debian GNU/Linux 12 (bookworm)

githubDiversity commented 1 year ago

I just saw a video on a reddit post about this issue; https://www.reddit.com/r/selfhosted/comments/14qi7ci/risk_of_selfhosting_smaller_projects/

I am not really getting any hints as to what is the reason behind this open bug on the comments there.

And I am rather shocked to find this issue is still open here without some motivation why it is left unresolved.

Could well be that this is a non issue but then it would be confidence inspiring to see a debate about that.

sbkg0002 commented 7 months ago

I think I also have this issue with the latest version; is there any solution?

In the feature issue, more users have this issue it seems - https://github.com/NginxProxyManager/nginx-proxy-manager/issues/356

github-actions[bot] commented 2 weeks ago

Issue is now considered stale. If you want to keep it open, please comment :+1: