Managing VPN Peers

Setup

Via the UI

The toggle sits in the route wizard in Step 4 — Access, directly above the peer checklist.

1. Create or edit a route
2. In Step 4 enable the Peer Access Control toggle
3. Select peers from the checklist (multiple selection possible)
4. Save

Via the API

# Enable ACL with selected peers (IDs: 1 and 3)
curl -X PUT https://gatecontrol.example.com/api/v1/routes/1 \
  -H "Authorization: Bearer gc_..." \
  -H "Content-Type: application/json" \
  -d '{
    "acl_enabled": true,
    "acl_peers": [1, 3]
  }'

Disabling

Turn off the ACL toggle → the route is reachable for everyone again.

Important notes

• ACL only blocks access via Caddy (HTTP/HTTPS routes). Direct VPN access between peers is not restricted.
• If a peer is disabled or deleted, it is automatically removed from the ACL.
• ACL only works for HTTP routes, not for L4 (TCP/UDP) routes.
• The ACL check is the first check Caddy performs — before auth, rate limiting or other handlers.

See also

• IP-ACCESS-CONTROL.md — Filtering by arbitrary IPs/CIDRs/countries
• concepts/routing.md — Order of access checks