Deny access to local subnets as well (not only 127.0.0.0/8)

schors / tgdante2

Dockerized Dante socks5 proxy for telegram. Alpine version

The Unlicense

626 stars 67 forks source link

Open justabaka opened 6 years ago

justabaka commented 6 years ago

That would be great in terms of security if you're also hosting other VMs or projects your proxy users shouldn't be able to access directly.

KostyaEsmukov commented 6 years ago

Denying RFC1918 blocks is certainly a good start, but these are definitely not the only ones which are private.

I'd suggest to also deny the following ones:

RFC5735 (which is updated by RFC6598) has a more complete list of reserved address blocks at section 4.

KostyaEsmukov commented 6 years ago

BTW for IPv6 the FC00::/7 block is also considered local (see RFC4193).