Restricting n8n hook subdomain
How to block access to n8n console under the hook subdomain
Some links may be affiliate links that keep this site running.
I run n8n for some automations as it allows me a visual view of what is happening.
My setup is quite simple.
- n8n console is facing an internal network on NetBird.
- n8n hooks is facing the public internet
One of the parts that was missing for me with n8n is the ability to restrict console access when someone is accessing the hooks subdomain that n8n is running under, currently there is no way to restrict that from happening, besides blocking that in your reverse proxy.
As I use HAProxy, I wrote a short access list, code is below. This goes into your frontend configuration.
1
2
3
4
5
6
7
8
9
# Configuration
acl n8n_webhook_host hdr(host) -i hook.yourdomain.com
acl n8n_webhook_path path_beg /webhook
# Allow and deny rules
http-request allow if n8n_webhook_host SHS_n8n_webhook_path
http-request deny if n8n_webhook_host !SHS_n8n_webhook_path
use_backend n8n if n8n_webhook_host n8n_webhook_path
You will notice that the backend is the same backend, and that’s because I only run 1 instance of n8n and haven’t broken it down to components.
run haproxy -c -f /etc/haproxy/haproxy.cfg to check the configuration.
You may get a few warnings that your rules are not ordered properly, but as long as the configuration is valid, it will work.
finish up with:
1
sudo systemctl reload haproxy