Login issues with IIS proxy

[mcinnes01 (Andy McInnes)]

Hi

I’m new to hass and have configured a subdomain to access it. At home I have a static IP with all my http/https traffic routed to my windows web server. Here I host various apps and services and I also proxy out to various bits of hardware that I want to access via a sub domain.

From what I can see hass is using web sockets for the login, currently I can get to the login page but I get a number of ws failures when I try to login.

I’ve tried various rewrites with my current being:

 			<rule name="ProxyToHassIO" enabled="true" stopProcessing="true">
				<match url=".*" />
				<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
					<add input="{CACHE_URL}" pattern="^(.+)://" />
				</conditions>
				<action type="Rewrite" url="{C:1}://192.168.1.71:8123/{R:1}" />
			 </rule>

Previously I was getting some errors on my network tab related to web sockets, but I’ve been through various tutorials and have all the related features enable in windows/IIS.

Currently I get this when I go to the sub.domain, opposed to the login and WS errors I saw previously.

Home Assistant had trouble
connecting to the server.

The IIS site for hass is running with no managed code and I’ve add both http and https bindings and am using Certify the web to provide a lets encrypt certificate. The cert if obviously on IIS opposed to directly being on hass and I have no config on hass relating to the cert.

Any help would be much appreciated, ps I’ve seen a few things about some issue with NGINX, but I have little to no experience with NGINX, I’m a dotnet developer by day so my experience is mainly around the microsoft stack.#

Cheers,

Andy

[GeoffAtHome]

Hi Andy,

Did you resolve your problems? I think I have a similar setup. I am running IIS and all my normal traffic is on HTTPS but I cannot get hassio routed correctly.

If you have resolve this issue and can share it that would be great.

Cheers,
Geoff

[Sibren]

I’m experiencing the same issue: I’ve created a rewrite (attached).web.config.xml (923 Bytes)

I’ve also tried replacing {R:0} with {R:1}, but I keep getting a 400 on the websockets.

[GeoffAtHome]

Hi Sibren,

Looks like we are not alone. These issues are similar:

[Solved] Access via IIS reverse proxy died after upgrade to 0.58

My remote access died after upgrading to Home Assistant 0.58. I does not pass the loading spinner. I’m using IIS reverse proxy (ARR) with Let’s Encrypt. LAN access still works fine. The regular procedure of cleaning the browser has no effect. Removing the http password did not help. Failed Request Tracing from IIS shows a 502.5 error with description ‘The server returned an invalid or unrecognized response’. This is on the /api/websocket resource and after exactly 1 second. When I downgrade …

IIS reverse proxy

I’m trying to get URL Rewrite working in IIS. My goal is to add home-assistant to my list of sub-apps, e.g. https://whatever.com/home-assistant/ How can I make HA serve at /home-assistant/ instead of at root / For example, a rewrite config might look like this <rule name="home-assistant" enabled="true" stopProcessing="true"> <match url="home-assistant/(.*)" /> <action type="Rewrite" url="http://192.168.1.2:8123/{R:1}" /> </rule> But s…

Hopefully someone can provide some detailed instructions that may help. At the moment all I get is a 404 which isn’t helping.

Cheers,
Geoff

[mcinnes01 (Andy McInnes)]

Hi

I haven’t had much time to play with this, but I would be interested to know what version of IIS and windows server you are running?

Basically I think there is an issue with the ARR module on IIS 8.5 that is fixed in IIS 10. You need to have the websockets module and ARR module installed, latest versions of each. It should just work then…

Essentially in 8.5 it’s not handling a header that gets added, I think some people have resolved it with rewrites but I am just in the process of updating some of my VMs to Server 2016.

Let me know how you get on.

Andy

[GeoffAtHome]

Hi Andy,

I am running IIS 10.0 on Windows Server 2016. I have installed ARR 3.0 and Websockets.

The current rewrite rule I am using, that doesn’t work is:

<rewrite>
    <rules>
        <rule name="Let's Encrypt" enabled="true" stopProcessing="true">
            <match url="(.well-known/acme-challenge/*)" />
            <action type="None" />
        </rule>
        <rule name="ReverseProxyInboundRule1" stopProcessing="true">
            <match url="(.*)" />
            <action type="Rewrite" url="http://192.168.15.94:8123/{R:0}" logRewrittenUrl="true" />
            <serverVariables>
                <set name="HTTP_SEC_WEBSOCKET_EXTENSIONS" value="" />
            </serverVariables>
        </rule>
        --->
    </rules>
</rewrite>

Much help is needed. Perhaps a guide for this setup would be useful as I believe several other people are running into the same problem.

Cheers,
Geoff

[mcinnes01 (Andy McInnes)]

I’ve finally found some time to get this to work, in the end I found the solution on the forums already…

1. Basically you need to start by creating two empty websites in IIS, one for Home Assistant and one for the Hass Configurator if you want to be able to make changes remotely.

2. Make sure you run the app pools as “No Managed Code”

3. Create two folders in your inetpub folder one for Home Assistant and for the Hass Configurator:

   • C:\inetpub\wwwroot\HomeAssistant
   • C:\inetpub\wwwroot\HassConfigurator

4. In each folder create a “web.config” file and a “.well-known” folder, make sure the folder name beings with a “.”.

5. In the web.config file in the Home Assistant folder add the following:

    <?xml version="1.0" encoding="UTF-8"?>
    <configuration>
    	<system.webServer>
    		<rewrite>
    			<rules>
    				<rule name="Forward to Home Assistant" enabled="true" stopProcessing="true">
    					<match url="(.*)" />
    					<action type="Rewrite" url="http://192.168.1.51:8123/{R:0}" logRewrittenUrl="true" />
    					<serverVariables>
    						<set name="HTTP_SEC_WEBSOCKET_EXTENSIONS" value="" />
    					</serverVariables>
    				</rule>
    			</rules>
    		</rewrite>
    		<webSocket pingInterval="00:00:20" enabled="true" receiveBufferLimit="4194303" />
    		<staticContent>
    			<mimeMap fileExtension="." mimeType="text/plain" />
    		</staticContent>
    	</system.webServer>
    </configuration>
   

6. In the Hass Configurator web.config add the following:

    <?xml version="1.0" encoding="UTF-8"?>
    <configuration>
    	<system.webServer>
    		<rewrite>
    			<rules>
    				<rule name="Forward to Hass Configurator" enabled="false" stopProcessing="true">
    					<match url="(.*)" />
    					<action type="Rewrite" url="http://192.168.1.51:3218/{R:0}" logRewrittenUrl="true" />
    					<serverVariables>
    						<set name="HTTP_SEC_WEBSOCKET_EXTENSIONS" value="" />
    					</serverVariables>
    				</rule>
    			</rules>
    		</rewrite>
    		<webSocket pingInterval="00:00:20" enabled="true" receiveBufferLimit="4194303" />
    		<staticContent>
    			<mimeMap fileExtension="." mimeType="text/plain" />
    		</staticContent>
    	</system.webServer>
    </configuration>
   

7. Back in IIS for both of the sites click on the Url Rewite module and select “View Server Variables”. Then add the following server variable: “HTTP_SEC_WEBSOCKET_EXTENSIONS”

The following will allow you to secure your site with SSL

8. For both sites in the IIS section, select Authentication and ensure you only have Anonymous enabled.

9. Then click edit on the anonymous option and ensure you select Application pool Identity.

10. Then install certify the web https://certifytheweb.com/ on your server, follow the instructions and when you get the option to automatically configure your site, select yes. This will create a file and some folders to validate your domain and add a web.config to allow static files to be served.

The web.config it create will be in the acme-challenge folder and should look like this:

	<?xml version="1.0" encoding="UTF-8"?>
	<!--
	  Example web.config to allow access to extensionless json text files under <website>/.well-known/acme-challenge folder

	  * map extensionless files (. wildcard) to json
	  * allow all users
	  * does not attempt to override static file handler from parent config
	-->
	<configuration>
	  <system.webServer>
		<validation validateIntegratedModeConfiguration="false" />
		<staticContent>
		  <mimeMap fileExtension=".*" mimeType="text/json" />
		</staticContent>
	  </system.webServer>
	  <system.web>
		<authorization>
		  <allow users="*" />
		</authorization>
	  </system.web>
	</configuration>

11. You may need to reorder the modules:

• Goto Site/Server->Handler Mappings->View Ordered List
• Move the StaticFile mapping above the ExtensionlessUrlHandler mappings.

Hopefully that should do you and you should have a fully working sub domain with SSL.

Also don’t forget to add host entries on your web server.

Finally I would recommend you add another rewrite to force all http request through to https.

Just and this in each web.config under the rule mentioned in step 5 and 6:

			<rule name="HTTPS to HTTPS Redirect" enabled="true" stopProcessing="true">
				<match url="(.*)" />
				<conditions logicalGrouping="MatchAny">
				  <add input="{SERVER_PORT_SECURE}" pattern="^0$" />
				</conditions>
				<action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" />
			</rule>

Last note you may need to disable the rules whilst you generate a certificate.

[newdamage1 (Kelly)]

I’ve just run through this setup on my Server 2016, but I’m still seeing a “Unable to connect to Home Assistant.” after login, and the HA log says "Login attempt or request with invalid authentication from ".

I tried a few configurations within the configuration.yaml:
Example

http:
  base_url: MyExternalDomain.com
  use_x_forwarded_for: true
  trusted_proxies: 10.10.200.50

Ideas on what needs to be tweaked would be appreciated!

setup notes:
HA is on centos 7 vm running on python virtual env.
reverse proxy is on a separate vlan running server 2016
I can login to HA O.K from the RP server, and local vlan.

[newdamage1 (Kelly)]

Figured it out, I didn’t have Web Sockets Protocol enabled under web server in roles and features.

[andrewjswan]

Do you have debugging automations working? Because the full HA interface works, but when debugging a blank screen, I see in the Chrome logs:

1. Request URL:

https://HOST:PORT/api/logbook/2021-06-16T04:19:25.028205+00:00?context_id=99999999999999999

2. Request Method:

GET

3. Status Code:

**404**

4. Remote Address:

XXX.XXX.XXX.XXX:XX

5. Referrer Policy:

same-origin

[Celer21]

Did you resolved problem with new debuggint automation?
Iam getting 404 error as well.

[andrewjswan]

No , so far I haven’t been able to figure out what the problem is. Also in ESPHome via Ingress the firmware assembly does not work.