diff --git a/test/test_internal/network_internal.conf b/test/test_internal/network_internal.conf
new file mode 100644
index 0000000..496e569
--- /dev/null
+++ b/test/test_internal/network_internal.conf
@@ -0,0 +1,11 @@
+# Only allow traffic from internal clients
+allow 127.0.0.0/8;
+allow 10.0.0.0/8;
+allow 192.168.0.0/16;
+allow 172.16.0.0/12;
+allow fc00::/7; # IPv6 local address range
+deny all;
+
+# Dummy header for testing
+add_header X-network internal;
+
diff --git a/test/test_internal/test_per-vhost.py b/test/test_internal/test_per-vhost.py
new file mode 100644
index 0000000..4586cc0
--- /dev/null
+++ b/test/test_internal/test_per-vhost.py
@@ -0,0 +1,14 @@
+import pytest
+
+def test_network_web1(docker_compose, nginxproxy):
+    r = nginxproxy.get("http://web1.nginx-proxy.local/port")
+    assert r.status_code == 200   
+    assert r.text == "answer from port 81\n"
+    assert "X-network" in r.headers
+    assert "internal" == r.headers["X-network"]
+
+def test_network_web2(docker_compose, nginxproxy):
+    r = nginxproxy.get("http://web2.nginx-proxy.local/port")
+    assert r.status_code == 200   
+    assert r.text == "answer from port 82\n"
+    assert "X-network" not in r.headers
diff --git a/test/test_internal/test_per-vhost.yml b/test/test_internal/test_per-vhost.yml
new file mode 100644
index 0000000..a935e53
--- /dev/null
+++ b/test/test_internal/test_per-vhost.yml
@@ -0,0 +1,24 @@
+web1:
+  image: web
+  expose:
+    - "81"
+  environment:
+    WEB_PORTS: 81
+    VIRTUAL_HOST: web1.nginx-proxy.local
+    NETWORK_ACCESS: internal
+
+web2:
+  image: web
+  expose:
+    - "82"
+  environment:
+    WEB_PORTS: 82
+    VIRTUAL_HOST: web2.nginx-proxy.local
+
+sut:
+  image: nginxproxy/nginx-proxy:test
+  volumes:
+    - /var/run/docker.sock:/tmp/docker.sock:ro
+    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
+    - ./network_internal.conf:/etc/nginx/network_internal.conf:ro
+
diff --git a/test/test_internal/test_per-vpath.py b/test/test_internal/test_per-vpath.py
new file mode 100644
index 0000000..e95fe00
--- /dev/null
+++ b/test/test_internal/test_per-vpath.py
@@ -0,0 +1,14 @@
+import pytest
+
+def test_network_web1(docker_compose, nginxproxy):
+    r = nginxproxy.get("http://nginx-proxy.local/web1/port")
+    assert r.status_code == 200   
+    assert r.text == "answer from port 81\n"
+    assert "X-network" in r.headers
+    assert "internal" == r.headers["X-network"]
+
+def test_network_web2(docker_compose, nginxproxy):
+    r = nginxproxy.get("http://nginx-proxy.local/web2/port")
+    assert r.status_code == 200   
+    assert r.text == "answer from port 82\n"
+    assert "X-network" not in r.headers
diff --git a/test/test_internal/test_per-vpath.yml b/test/test_internal/test_per-vpath.yml
new file mode 100644
index 0000000..1ea470f
--- /dev/null
+++ b/test/test_internal/test_per-vpath.yml
@@ -0,0 +1,28 @@
+web1:
+  image: web
+  expose:
+    - "81"
+  environment:
+    WEB_PORTS: 81
+    VIRTUAL_HOST: nginx-proxy.local
+    VIRTUAL_PATH: /web1/
+    VIRTUAL_DEST: /
+    NETWORK_ACCESS: internal
+
+web2:
+  image: web
+  expose:
+    - "82"
+  environment:
+    WEB_PORTS: 82
+    VIRTUAL_HOST: nginx-proxy.local
+    VIRTUAL_PATH: /web2/
+    VIRTUAL_DEST: /
+
+sut:
+  image: nginxproxy/nginx-proxy:test
+  volumes:
+    - /var/run/docker.sock:/tmp/docker.sock:ro
+    - ../lib/ssl/dhparam.pem:/etc/nginx/dhparam/dhparam.pem:ro
+    - ./network_internal.conf:/etc/nginx/network_internal.conf:ro
+