How to disable IP based login?

[emoun]

I have applied Cloudflare Zero Trust 2FA (OTP via Email) authentication to both HestiaCP and WordPress login pages.

The HestiaCP login page can be accessed at https://cp.mydomain.tld:2083

However, direct access to https://IP-Address:2083 bypasses Cloudflare Zero Trust 2FA.

Can you please tell me how to disable direct IP login for HestiaCP?

[linkp]

You would need to firewall off access to that IP and port combination from anywhere except wherever Cloudflare Access connects from.

[eris]

You can’t currently

[emoun]

Is there any workaround using Ngnix?

[eris]

The only method you can use is to block port 8083 completely and use the templates from:

Run HestiaCP ONLY on subdomain without other domains

Hello! How I can configure HestiaCP only on subdomain, for example cp.domain,com without port? I have some domains and I can open CP on every domain - domain1,com:8083, domain2,net:8083, etc. How do I close access to a domain other than the host (cp.domain,com)? v1.8.5.

cp.tpl / stpl

You probally want to change the port back to 8083 in that case (or adjust te template)

[emoun]

Thanks, i will look into this and let you know.

Can you please add my usecase as a feature request for the next releases of hestiacp.

Direct IP based login should be disabled.

[schiwe]

You need to allow access only to cloudflare ips on your HestiaCP Firewall.
https://www.cloudflare.com/ips-v4/#

[emoun]

This works like a charm!
Thanks.

This feature is built-in in CloudPanel for security purpose.