Any tips or tricks on this one? I just can’t seem to get HA to work behind cloudflare.
Current Setup: Cloudflare -> Apache Reverse Proxy port 8443 -> HA port 8123
I can connect directly to the IP of the Apache Reverse Proxy on port 8443 and everything works perfectly, however when I try to connect through Cloudflare I get a blank page with HA’s trademark blue bar across the top.
I looked through my Cloudflare settings, and websockets are enabled, and I have a page rule set for www.domainname.com:8443/* of Browser Integrity Check: Off, Rocket Loader: Off, Always Online: Off, Cache Level: Bypass
I am using Home Assistant using Cloudflare and it took a decent amount of work to set up. I am using haproxy on my router (LEDE/OpenWrt) to manage the connections from external. I have everything coming in on port 443 to my haproxy and pass traffic to the backends using SNI.
This is my configuration with all the private information edited out:
Thanks for the reply. I seem to have figured out what’s happening, and a workaround, but not why it’s happening, or how to fix it.
I have HA on my home network using a 192.168.x.x IP, and also on my VPN using a 10.x.x.x IP. Then I have my server hosted on a VPS outside of my home which has a public IP, as well as a connection on the VPN 10.x.x.x subnet. And then I have Cloudflare pointing to the public IP of the server.
If I’m using a device that is not connected to the VPN, and I connect to Cloudflare using port 8443 everything works properly. But as soon as the device I’m on is also connected to the VPN, I can no longer connect by going to port 8443 on cloudflare, and must instead use the 10.x.x.x IP to connect (or if I’m at home, the 192.168.x.x IP works as well).
I have no idea why this is as I have no issues at all accessing any other site on the internet while on the VPN,
including accessing sites that are on port 80 of the same server through the same Cloudflare account, But I’ve learned to live with it.
It’s mostly not an issue as for the most part none of my user devices live on the VPN, and I reserve it for my services (3 permanent hosts on the VPN, the Home Assistant instance, my car, and my web/mail/etc server which is the single point where I can control my home and car automations. I tend to only connect one of my user devices to the VPN when I need to modify settings or do some programming)
No, they are not.
Internally I connect to host.domain:8123 whereas externally I connect to www.domain:8443
I can connect to www.domain:80 just fine when I’m on the VPN, but if I try to go to www.domain:8443 it doesn’t go and I have to use host.domain:8123 instead
host.domain resolves to 10.x.x.x (IP on the VPN of the RPI running HA)
www.domain resolves to a cloudflare IP which then forwards the traffic to a web server on a VPS which has a second interface on the VPN which then reverse proxies the traffic to the HA instance listed above. This same server has a normal Apache instance running on ports 80 and 443 (HTTP and HTTPS) which work just fine regardless of how I’m connected.
When not connected to the VPN I can go to www.domain:8443 and access HA no problem using the apache reverse proxy.
Of note, my VPN is not setup to route any traffic by default, so only traffic destined for a 10.x.x.x IP should ever end up flowing over the VPN, and no DNS is done over the VPN, it’s all done over the normal internet link and does not change depending on whether the VPN is connected or not.
This comment helped me out quite a bit. Home Assistant was only showing the top bar while viewing from Chrome Desktop. It still worked via Chrome on Android, Safari and Firefox.
I had recently changed to a new host behind the reverse proxy, and so I originally thought this was the issue. I spent a good deal of time troubleshooting.
My setup looks like this:
Cloudflare -> Nginx -> Home Assistant on Ubuntu 17.10
Eventually I stumbled across this post, made the Page Rules and it fixed the problem. Thanks for posting.
I use a CNAME record in Cloudflare that points to an A record that is updated on Cloudflare via DDNS. Deleting this CNAME record, and temporarily adding an A record that pointed directly at my IP seemed to fix this issue, whether or not requests were routed through Cloudflare.
This was not an issue while I was running Home Assistant on 16.04. It only seems to have caused problems when I moved my install to a new container (LXC) running on 17.10.
Lets me lock down port 443 on my end to only accept CF traffic based on IP rules.
Granted sure you could still find ways to discover my public IP but I feel its better than not doing anything at all. Oh and its free
EDIT: Also from the hosted DNS front makes renewing my SSL with letsencrypt a snap. I only route external inbound traffic through CF. If we’re hitting a site from inside i.e. HA while I still have the SSL on it this way I still have a valid LetsEncrypt SSL on HA for internally. I could use the cert provided from CF but this is easier. I also have it setup with CF for full-strict encryption so all traffic passed between me and CF is fully encrypted.
Now granted yes CF has the ability to look at the traffic as it passes through them since they decrypt from me and then encrypt it again with the end user, I’m not terribly worried about it as I’m not doing anything crazy here at home
I use pfsense as my firewall and CF publishes their IP lists. So I just created a rule to pull that list daily. So I just put that in my source IP field for port 443 and 80.
Thanks for the feedback. I also use pfSense as my firewall and have haproxy as a reverse proxy.
I’ve been experiencing some issues with my new cellphone carrier (Sprint) to remotely connect to HA. I’ll try this approach with CF to see if it solves the problem.