Hello,

 

I hope you have a good day.

 

I have multiple dockers that I can access from LAN without authentication so how can I protect it behind an authentication app?

For example, I have Brave browser which anyone from my local network can access by 10.10.0.4:5830. However, I want a specific user who can log in to that port.

 

Is that possible?

 

Thank you. 

The first thing you will need is a reverse proxy app to route all of your applications through a single authenticated address. I personally use traefik with organizr as an authentication app. That said these are probably more complete alternative solutions .

 

I would indeed suggest looking into a reverse proxy to give them all a DNS name, then limiting access to allow only connections coming from that proxy, for example Nging Proxy Manager:  

 

 

Then you can use something like Authelia to control access and put passwords/2fa prompts on the websites: 

I use this myself as well, works pretty good!

 

Limiting access to the containers can for example be done by creating an extra vlan and then disabling inter-vlan routing.😄

Edited June 26, 20224 yr by jeffrey.el

Thanks Primeval_god and Jeffrey.el for your reply.

 

I have my dockers behind Nginx Proxy Manager and secure them with Authelia and 2FA for my domain.

 

The issue that I'm facing is only when two computers joins a local network. Each computer can access any docker without a user name and password.

 

I think the only solution to fix this issue is as Jeffrey.el mention by adding VLAN then disabling inter-vlan routing.

 

Hope you have a wonderful day. 

Edited June 27, 20224 yr by adminbyme

7 hours ago, adminbyme said:

The issue that I'm facing is only when two computers joins a local network. Each computer can access any docker without a user name and password.

If you are using a reverse proxy container and both it and the container you are proxying are connected to a custom bridge docker network for internal communication then there is no need to make map the application containers ports to the accessible ports on the unraid host. Without the port mapping the only way to access the application is through your secured reverse proxy. 

Edited June 27, 20224 yr by primeval_god

Nice. I got it. Thank you so much Primeval_god.

 

I'll try it later and see how it goes since I run my NPM as a bridged network. I just created a new docker network and I'll change some docker to that network.

 

Also in case you werent aware when two containers are connected to the same custom bridge they have a DNS mapping for each other matching their container name.