Caddy http access issues

[NeoDragon]

Hi,

I've been using caddy plugin for a little while. Recently, http access started acting up and not allowing ip's included in the addresses, specifically opnvpn subnet.

VPN subnet is on 192.168.50.1/24
Local Subnet is on 192.168.0.0/16

Tried adding 192.168.0.0/16 and the 192.168.50.2 ip (the vpn user address) and it still doesn't work.

As soon as I remove access restriction, everything starts to work again.
------

As i was typing this, I figured it out looking to share the caddyfile.
Invert option might be "inverted", as in it denies access to ip address listed instead of allowing.

Inverted not checked : not client_ip 192.168.0.0/16 192.168.50.2
Inverted checked : client_ip 192.168.0.0/16 192.168.50.2

[Monviech (Cedrik)]

Invert not checked should:

"If the client ip /is not/ 192.168.0.0/24, then abort the connection."

Invert checked should:

"If the client ip /is/ 192.168.0.0/24, then abort the connection."

After that match, all IPs that fall through and are not aborted are allowed.

Also keep in mind its the actual client IP on Layer 7 in the header the client sends in the HTTP or HTTPS request. It can be a different one than expected. You have to inspect the HTTP access log.

Maybe that connection doesnt take the route through the VPN but around it and comes with an external IP.

[NeoDragon]

You were right, even tho VPN traffic is routed and i can access local ip's and all, caddy is still getting a WAN ip from http log instead of local id.

Any way to change that?

[Monviech (Cedrik)]

Well yeah that can be changed but that has nothing to do with caddy.

Read on the difference between a Split Tunnel and Full Tunnel VPN.

Another option is Split DNS while the tunnel is connected.