Messages

Hi Cedrik,

sadly, I habe a dynamic IPv6 prefix and my ISP (1&1) is not willing to change that.

I looked through the forum and found you mentioning that it might be possible to use the API via a PHP script to add the dynamic prefix to the access list.

I chatgpted my way through the API documentation, but I couldn't figure out how to update the access list. My problem is that I could not find a unique UUID for the access list. When I looked through the caddy file, I noticed that the UUID is always attached to the subdomain, for example "@cff47bd5-bb15-4551-89bc-9eef1b952b06_pagedomainnet"

My first guess is that I use the script to update the caddy config, but I think that's a stupid idea because then I would no longer be able to use the GUI if my understanding is correct.

Here is the script "I" created with the help of ChatGPT, sadly I am not a programmer, but I work in IT, so I am a little bit familiar with scripting (PowerShell).

Github Link

Code Select Expand

#!/usr/local/bin/php

<?php// === Konfiguration ===$interface        = "pppoe0";                                 // Name des Netzwerkinterfaces$prefixLength     = 64;                                      // Prefix-Länge (z. B. 56)$accessListUUID   = "cff47bd5-bb15-4551-89bc-9eef1b952b06"; // UUID des Access-List-Eintrags// API-Zugangsdaten$api_base_url     = "https://opnsense.domain.net/api/caddy/"; // Basis-URL$api_key         = "xxx";$api_secret      = "xxx";// Statische IPv4-Bereiche$ipv4_allowed = [    "192.168.0.0/16",    "172.16.0.0/12",    "10.0.0.0/8"];// === Funktionen ===function callApi($endpoint, $method = "GET", $data = null) {    global $api_base_url, $api_key, $api_secret;    $url = $api_base_url . $endpoint;    $ch = curl_init($url);    if ($ch === false) {        echo "Fehler bei curl_init(): " . curl_error($ch) . "\n";        return null;    }    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);    $headers = [        "Content-Type: application/json",        "X-API-Key: $api_key",        "X-API-Secret: $api_secret"    ];    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);    if ($data !== null) {        $jsonData = json_encode($data, JSON_PRETTY_PRINT);        curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonData);    }    $response = curl_exec($ch);    if ($response === false) {        echo "Fehler beim Curl-Request: " . curl_error($ch) . "\n";        curl_close($ch);        return null;    }    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);    if ($httpCode != 200) {        echo "HTTP-Fehler: " . $httpCode . "\n";        echo "Antwort: " . $response . "\n";        curl_close($ch);        return null;    }    curl_close($ch);    $decodedResponse = json_decode($response, true);    if (json_last_error() !== JSON_ERROR_NONE) {        echo "Ungültige JSON-Antwort: " . json_last_error_msg() . "\n";        return null;    }    return $decodedResponse;}function getIPv6Address($interface) {    $cmd = "ifconfig " . escapeshellarg($interface) . " | awk '/inet6 / && !/fe80/ && /prefixlen/ {print $2; exit}'";    $ipv6 = trim(shell_exec($cmd));    if (empty($ipv6)) {        echo "Fehler: Keine IPv6-Adresse gefunden oder Befehl fehlgeschlagen.\n";        return false;    }    return $ipv6;}function calculateIPv6Prefix($ipv6, $prefixLength) {    $groups = explode(":", $ipv6);    if (count($groups) < 4) {        return false;    }    $g1 = $groups[0];    $g2 = $groups[1];    $g3 = $groups[2];    $g4 = $groups[3];    $g4 = str_pad($g4, 4, "0", STR_PAD_LEFT);    $prefixPart = substr($g4, 0, 2) . "00";    $networkPrefix = "$g1:$g2:$g3:$prefixPart::";    return $networkPrefix;}// === Hauptlogik ===$ipv6_address = getIPv6Address($interface);if ($ipv6_address === false) {    echo "Fehler: Keine IPv6-Adresse auf Interface $interface gefunden.\n";    exit(1);}echo "Gefundene IPv6-Adresse: $ipv6_address\n";$dynamicPrefix = calculateIPv6Prefix($ipv6_address, $prefixLength);if ($dynamicPrefix === false) {    echo "Fehler beim Berechnen des IPv6-Netzwerk-Prefix aus $ipv6_address\n";    exit(1);}$dynamicPrefixWithCIDR = $dynamicPrefix . "/" . $prefixLength;echo "Berechneter dynamischer IPv6-Prefix: $dynamicPrefixWithCIDR\n";$allowedNetworks = array_merge($ipv4_allowed, [$dynamicPrefixWithCIDR]);$updateData = [    "uuid" => $accessListUUID,    "client_ip" => $allowedNetworks];$jsonData = json_encode($updateData, JSON_PRETTY_PRINT);var_dump($jsonData);echo "Sende Update an die Access-Liste (UUID: $accessListUUID)...\n";$updateResponse = callApi("reverseproxy/setAccessList/" . $accessListUUID, "POST", $updateData);if ($updateResponse === null) {    echo "Fehler beim Aktualisieren der Access-Liste.\n";    exit(1);}// Überprüfe die API-Antwort auf Erfolgif (isset($updateResponse['status']) && $updateResponse['status'] !== 'success') {    echo "Fehlerhafte API-Antwort: " . $updateResponse['message'] . "\n";    var_dump($updateResponse);    exit(1);}echo "Access-Liste erfolgreich aktualisiert.\n";echo "Löse Neukonfiguration von Caddy aus...\n";$reconfigResponse = callApi("reverseproxy/service/reconfigure", "POST", []);if ($reconfigResponse === null) {    echo "Fehler beim Auslösen der Neukonfiguration.\n";    exit(1);}echo "Caddy wurde erfolgreich neu konfiguriert.\n";exit(0);?>

Well, I tested it on my work laptop which has IPv6 disabled, and it works... I disabled IPv6 on my desktop PC, and it also works now :)

Now I have to figure out how to set up my network to properly support IPv6.

I currently struggle a bit with the Caddy http access list, I followed the Docs and everything works like a dream but sadly as soon as I enable the "private_ipv4" Access List I can't access my stuff.domain.net neither external nor internal.

I am using my phone which is on cellular to test external, and my pc to test internal

here is my caddyfile:

Code Select Expand

# DO NOT EDIT THIS FILE -- OPNsense auto-generated file


# caddy_user=root

# Global Options
{
    log {
        output net unixgram//var/run/caddy/log.sock {
        }
        format json {
            time_format rfc3339
        }
        level DEBUG
    }

    servers {
        protocols h1 h2 h3
    }

    dynamic_dns {
        provider ovh {
        #    redacted
        }
        domains {
            domain.net *
            domain.net haus
        }
    }

    email ###
    grace_period 10s
    import /usr/local/etc/caddy/caddy.d/*.global
}

# Reverse Proxy Configuration


# Reverse Proxy Domain: "922091ee-1d99-4c1a-a59f-7f3bf9087262"
*.domain.net {
    log {
        output file /var/log/caddy/access/922091ee-1d99-4c1a-a59f-7f3bf9087262.log {
            roll_keep_for 10d
        }
    }
    tls {
        issuer acme {
            dns ovh {
            }
        }
    }

    @4210526e-5403-4ee8-a97b-6c77cbcb371f {
        host haus.domain.net
    }
    handle @4210526e-5403-4ee8-a97b-6c77cbcb371f {
        handle {
            reverse_proxy haus.internal:8123 {
            }
        }
    }
    @e0347484-55ea-4dd0-b50c-f6b74efd16cd {
        host pve01.domain.net
    }
    handle @e0347484-55ea-4dd0-b50c-f6b74efd16cd {
        @cff47bd5-bb15-4551-89bc-9eef1b952b06_pve01domainnet {
            not client_ip 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8
        }
        handle @cff47bd5-bb15-4551-89bc-9eef1b952b06_pve01domainnet {
            abort
        }

        handle {
            reverse_proxy https://pve01.internal:8006 {
                transport http {
                    tls_insecure_skip_verify
                }
            }
        }
    }
    @fb9e6f2f-4d02-4b5b-944d-8a1bbc520c27 {
        host page.domain.net
    }
    handle @fb9e6f2f-4d02-4b5b-944d-8a1bbc520c27 {
        @cff47bd5-bb15-4551-89bc-9eef1b952b06_pagedomainnet {
            not client_ip 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8
        }
        handle @cff47bd5-bb15-4551-89bc-9eef1b952b06_pagedomainnet {
            abort
        }

        handle {
            reverse_proxy lxc-docker-host.internal:3000 {
            }
        }
    }
    @b1aa60b9-e9cc-493e-ab5b-db3b3cb8ad5f {
        host amp.domain.net
    }
    handle @b1aa60b9-e9cc-493e-ab5b-db3b3cb8ad5f {
        @cff47bd5-bb15-4551-89bc-9eef1b952b06_ampdomainnet {
            not client_ip 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8
        }
        handle @cff47bd5-bb15-4551-89bc-9eef1b952b06_ampdomainnet {
            abort
        }

        handle {
            reverse_proxy vm-pterodactyl.internal:8080 {
                transport http {
                }
            }
        }
    }
    @271f3871-f4b0-4e56-a1aa-b2ac0e36f2d8 {
        host mc.domain.net
    }
    handle @271f3871-f4b0-4e56-a1aa-b2ac0e36f2d8 {
        handle {
            reverse_proxy vm-pterodactyl.internal {
                transport http {
                }
            }
        }
    }
}

import /usr/local/etc/caddy/caddy.d/*.conf





Runing OPNsense 25.1-amd64 with the newest caddy version

Ah and sorry for hijacking this post, I can open a new one if that would be better!
Thanks for this awesome plugin @Monviech