A modern, fast and security-hardened Network Diagnostic Looking Glass built with Nuxt. It enables visitors to run outbound network tests directly from your server's edge to any public target on the internet.
Live Demo: https://lg.demo.kozmalev.hu
Spin up the container with your node's public details:
docker run -d \
--name looking-glass \
--restart unless-stopped \
-p 3000:3000 \
--cap-add=NET_RAW \
-e NUXT_PUBLIC_ASN="YOUR-ASN" \
-e NUXT_PUBLIC_IPV4="YOUR_IPV4" \
-e NUXT_PUBLIC_IPV6="YOUR_IPV6" \
ghcr.io/b1glev/looking-glass:latestNote: The
--cap-add=NET_RAWflag is required so the non-root container process can craft raw ICMP packets.
- Hosting & VPS providers: Give prospective and current clients a self-service tool to test outbound connectivity, latency and packet loss directly from your network node towards any public destination (Cloudflare, Google, AWS or their own servers).
- Self-Hosted Enthusiasts: Expose a safe, isolated portal from your home lab or home server to measure outbound peering quality or test local ISP routing.
- Network & Community operators: Ideal for small ISPs and community networks that want to showcase their transit providers and routing paths to the outside world securely.
What visitors can do:
Measure latency between your server and any public IP or domain. Inspect routing paths, hops and peerings leaving your infrastructure. Diagnose transit packet loss or routing anomalies across upstream providers.
Exposing network diagnostic utilities to the public can be risky. This Looking Glass is hardened from the ground up using a defense-in-depth approach across multiple layers:
- Input Validation
- Safe Subprocess Execution
- SSRF Prevention
- DNS Validation
- Resource Limiting
- Process Lifetime
- Containerization
Input Validation
All incoming parameters pass through a strict Zod validation schema. Hostnames must adhere to valid FQDN patterns, while IP addresses are strictly validated. Any payloads containing shell metacharacters or HTML tags are rejected immediately before touching the application layer.
Safe Subprocess Execution
Commands are never executed via child_process.exec() or shell wrappers. Instead, the application uses child_process.spawn() with explicit, pre-sanitized argument arrays. This completely removes the underlying shell interpreter from the execution chain, rendering injection attacks impossible.
SSRF Prevention
Using ipaddr.js, the service evaluates the full scope of requested addresses. It blocks private IPv4/IPv6 ranges (RFC 1918, RFC 4193), loopback addresses, link-local interfaces and cloud metadata endpoints. Crucially, it blocks transition mechanisms and tunnels frequently used to bypass firewalls-such as 6to4, Teredo, and IPv4-mapped IPv6 addresses-along with internal top-level domains.
DNS Validation
To prevent DNS rebinding and internal host reconnaissance, the server resolves any target domain to all its corresponding A and AAAA records using DNS lookups before executing diagnostic binaries. If any resolved IP address belongs to a restricted or private range, the request is aborted immediately.
Resource Limiting
An in-memory Token Bucket rate limiter regulates request frequency per client IP. While not intended as network-level DDoS mitigation, it effectively prevents individual users or simple scripts from spamming executions and saturating system CPU or network interfaces.
Process Lifetime
Every diagnostic utility is strictly bound to a 30-second hard execution timeout, after which unresponsive commands are forcefully killed. Furthermore, if a visitor navigates away, refreshes the page or aborts the connection, the SSE stream detects the closure and immediately terminates the underlying process, preventing zombie processes and resource starvation.
Containerization
The deployment container drops all root privileges and runs as an unprivileged node user. Instead of granting wide root access to the entire container to send raw ICMP packets, specific Linux file capabilities, such as cap_net_raw, are set directly on the ping, traceroute and mtr binaries during build time.