[Feature Request]: Restrict access to shared site based on client IP

[nspaul]

I am using Herd and Expose Pro to host a site, as you do, and it is working great. The site that I am working on is very strictly an internal tool for my company, and I would like to not accidentally expose any parts of the site to the world. Is it possible to get the client's true public IP from within my Laravel application, so that I can restrict access to my company's internal subnets? I'm trying to bake this into a middleware, but the concept could work anywhere. In my middleware, though, when I try to capture the client's IP using $request->ip(), or even $_SERVER['REMOTE_ADDR'], it is showing 127.0.0.1. This happens whether I access the site from my local dev machine, or a random laptop on the public internet. Basically, I want to host my site using Expose Pro, but simultaneously apply a little "mini-firewall" to the hosted site.

If there is some other clean way to accomplish this, please chime in, I'm all ears!

[nspaul]

I think the simple answer to this is to detect the client's IP by grabbing $_SERVER['HTTP_X_FORWARDED_FOR']. This is certainly working, but it would be pretty neat to be able to specify allowable IPs from within the herd share ... command.

I know it's unfair to compare products at times, but it appears that ngrok does something like this: https://ngrok.com/docs/http/ip-restrictions/