ginnoir/homelabstack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(caddy): allow Tailscale CGNAT range in internal_only snippet
Deploy to valhalla / deploy (push) Has been cancelled
Details

Browse Source 
Tailnet clients that reach Caddy without subnet-route SNAT arrive from
100.64.0.0/10 and were getting 403 from LAN-only site blocks. Add the
range to the internal_only matcher so split-DNS tailnet access works
regardless of the --snat-subnet-routes setting.
This commit is contained in:
ginnoir
2026-06-06 20:31:39 -05:00
parent 04202a97b7
commit ca4cdf3d8a
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Caddyfile
+4 -2
View File
@@ -8,10 +8,12 @@
# ============================================================= # =============================================================
# SNIPPETS # SNIPPETS
# ============================================================= # =============================================================
# Reusable matcher — blocks anything not on the LAN. # Reusable matcher — blocks anything not on the LAN or tailnet.
# Usage: import internal_only inside any site block. # Usage: import internal_only inside any site block.
# 100.64.0.0/10 is the Tailscale CGNAT range — allows tailnet clients that
# reach Caddy without subnet-route SNAT (i.e. --snat-subnet-routes=false).
(internal_only) { (internal_only) {
@blocked not remote_ip 192.168.1.0/24 172.16.0.0/12 127.0.0.1 @blocked not remote_ip 192.168.1.0/24 172.16.0.0/12 100.64.0.0/10 127.0.0.1
respond @blocked "Access denied" 403 respond @blocked "Access denied" 403
} }