Filtering allowed hosts / IPs - Host header allows firewall bypass

[voltagex (Adam Baxter)]

Only allow certain IPs to access the server in reverse proxy

1. Caddy version (caddy version): v2.3.0 h1:fnrqJLa3G5vfxcxmOH/+kJOcunPLhSBnjgIvjXV/QTA= 2. How I run Caddy: system service a. System environment: Ubuntu Server 18.04 LTS b. Command: systemctl start caddy c. Service/unit/compose file: Same as official doc in dist/caddy.service at master · caddyserver/dist · GitHub d. My complete Caddyfile or JSON config: my.website { reverse_proxy 127.0.0.1:8080 } 3. The problem I’m having: I am doing reverse proxy. I want to allow ce…

I tried this, with @not_local_ip not remote_ip 127.0.0.1/32, but it seems like there’s an issue there in that I can bypass this with an X-Forwarded-For header!