Is this secure? (domain spoofing?)

Traefik Traefik v2
1

Hi,
I have 2 domains:
mydomain.com -> points to my external ip
intranet.mydomain.com -> points to an internal ip (192.168.0.2)

Some of my services I only want accessible from my LAN.
for those sevices i set Host to intranet.mydomain.com
E.g.
traefik.http.routers.router1.rule=Host(intranet.mydomain.com)&& (PathPrefix(/myservice)

Is it possible access intranet.mydomain.com/myservice from outside my LAN by somehow requesting that domain directly from my external ip?

2

Hi,

Yes, it's possible. (so no, it's nos secure)

For example :

  • Edit your hosts file (/etc/hosts for linux, C:WINDOWS/system32/drivers/etc/hosts for windows)
  • Add the line <external_ip> intranet.mydomain.com
  • Save
  • Tadam !

In this example, I told my computer to resolve your local name with your remote IP.
With TLS, IP and domaine name are distinct.
With HTTP, this is the header Host to defien which domaine name you want to use.
So, applications are free to request your external IP with any domaine name.

You should listen to local IPs only.
(I can't help on this point, sorry ^^')

Regards,
LeNouveau

1 Like
3

With curl, it's even easier.

curl -H "Host: intranet.mydomain.com" http://mydomain.com/
1 Like
4

Thanks, guessed it would be so, have to look into ip-whitelisting then. Tried the Curl method but was not able to get a reply from the intranet service so I was hoping that traefik did some magic that I did not know about.

5

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.