From ca4cdf3d8ab8663efa4e04ce9c5f6cc5eb49faba Mon Sep 17 00:00:00 2001 From: ginnoir Date: Sat, 6 Jun 2026 20:31:39 -0500 Subject: [PATCH] fix(caddy): allow Tailscale CGNAT range in internal_only snippet Tailnet clients that reach Caddy without subnet-route SNAT arrive from 100.64.0.0/10 and were getting 403 from LAN-only site blocks. Add the range to the internal_only matcher so split-DNS tailnet access works regardless of the --snat-subnet-routes setting. --- Caddyfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Caddyfile b/Caddyfile index 2bbe2e1..c073064 100644 --- a/Caddyfile +++ b/Caddyfile @@ -8,10 +8,12 @@ # ============================================================= # SNIPPETS # ============================================================= -# Reusable matcher — blocks anything not on the LAN. +# Reusable matcher — blocks anything not on the LAN or tailnet. # Usage: import internal_only inside any site block. +# 100.64.0.0/10 is the Tailscale CGNAT range — allows tailnet clients that +# reach Caddy without subnet-route SNAT (i.e. --snat-subnet-routes=false). (internal_only) { - @blocked not remote_ip 192.168.1.0/24 172.16.0.0/12 127.0.0.1 + @blocked not remote_ip 192.168.1.0/24 172.16.0.0/12 100.64.0.0/10 127.0.0.1 respond @blocked "Access denied" 403 }