Access settings for client identifier

[agitoxin]

Hello

I'm trying the client ID in DoH with my phone and it works like a charm.
However, I couldn't utilize this feature to block unknown devices from network because the DNS settings>Access settings>Allowed clients only takes CIDR or IP addresses.

Since we could identify devices from DoH now, is it possible to allow or block a client by its identifier?

[Izya12]

Good afternoon.
I would like to add, we need the ability to pass only the allowed doh clients, blocking the rest.

Добрый день.
Хотел бы дополнить, нужна возможность пропускать только разрешенных doh клиентов, остальных блокируя.

[ameshkov]

@Izya12 please upvote the original issue if you want it to be implemented.

[coxde]

This is a great feature to keep my ADH server private.

[windware-ono]

Even if I attempt to set the global setting to have an invalid upstream only allowing the defined clients by identifier to access to a proper upstream, this breaks for all the defined clients as well.

Same if I define clients by identifier and let it use a proper upstream but define a 0.0.0.0/0 as clients with an invalid upstream.

This needs to be implemented to avoid strangers from utilizing the resolver.

[ainar-g]

@windware-ono, if you want to create an allowlist of clients then you can already do that with the DNS Settings → Access settings → Allowed clients setting. Although it currently only works for IP addresses and subnets, not ClientIDs.

[windware-ono]

Yes, I'm aware of it but currently I'm running AH on a public network and my devices not belonging to specific IPs all the time and anyone who finds it's running a resolver can utilize it but if I can limit who can use it via client identifier as a sort of password, that would be very useful.

[carrot-eggs]

Customizing the upstream through the client ID cannot take effect, and it will still be resolved through the upstream DNS set globally, as shown in the figure：

My adguardhome is installed on a VPS, and I cannot set up a dedicated upstream DNS for a certain device through the client ID.

adguardhome version: v0.106.3

[ainar-g]

@carrot-eggs, hi, this issue is about access settings. Please post your report as a separate issue. Thanks.

[ainar-g]

@agitoxin, this feature is now implemented on the edge channel as of snapshot e08a64e. Can you please check if it works for you?

[agitoxin]

@ainar-g , I have refreshed the service to the latest snapshot 232cd38 and tested the "Allowed clients" and "Disallowed clients" with multiple client IDs, it works excellent! Also, I have tried to allow a device's IP but disallow its client ID. This result in allowing the device, which is surprisingly match to the description. Thanks a lot. I'll close the issue.