connection to private IP or self ignored service=https

[yaser-k]

why is connection to private IP ignored? I want to implement sniproxy in a lan and therefore the IP that sniproxy returns to clients is a private range.

[mosajjal]

in

sniproxy/https.go

Line 57 in 5e34eee

if rAddr.IsLoopback() || rAddr.IsPrivate() || rAddr.Equal(net.IPv4(0, 0, 0, 0)) || rAddr.Equal(net.IP(c.PublicIPv4)) || rAddr.Equal(net.IP(c.sourceAddr)) || rAddr.Equal(net.IP(c.PublicIPv6)) {

, any connection to RFC1918 addresses are blocked. This is mainly implemented to prevent rebinding attacks or SSRF against the VPS infrastructure on the open internet. I can consider an option switch to allow local IPs for sniproxy but it'll be off by default.

[yaser-k]

That would be great if we have such option

…

On Sun, Sep 10, 2023 at 7:38 AM Ali Mosajjal ***@***.***> wrote: in https://github.com/mosajjal/sniproxy/blob/5e34eee5b2eaeda69aba39447c3d605250607ff6/https.go#L57, any connection to RFC1918 addresses are blocked. This is mainly implemented to prevent rebinding attacks or SSRF against the VPS infrastructure on the open internet. I can consider an option switch to allow local IPs for sniproxy but it'll be off by default. — Reply to this email directly, view it on GitHub <#74 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AL2P65MDKLYS2OZ62JBEH2TXZU4K3ANCNFSM6AAAAAA4RUVMDU> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[mosajjal]

#80