Reverse proxy error

[koying (Chris B)]

I guess it depends how you see containers.
I see them as a convenience, not really as a security mechanism, and definitely not for HA.

From a KISS perspective, adding components to workaround security settings that you decided to implement yourself seem dubious

[Hamsterman]

Worked for me aswell - I am using Traefik as proxy

[martymarty004 (Martino)]

After my last message I had to edit my configuration to include all addons IPs because when I upgraded and restarted Home Assistant OS the IP of Nginx changed and it broke again.

This is my working configuration:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 127.0.0.1
    - 172.16.0.0/12
    - ::1

[kung_fury (Janis)]

I am running HA inside a docker container on my Raspberry Pi 3 with nginx as a reverse proxy running on a Raspberry Pi Zero and had the same issue and removing proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; also solved it for me. Thank you for sharing @dvoijen .

@frenck Can you maybe explain the security risk here? I am not to deep into that topic and don’t get it.

[meldarionqeusse (Meldarion)]

this worked for me as well. Thank you

[surfrock66 (Joseph T Gullo)]

At this point does anyone have a working config for a reverse proxy with apache? I’ve seen configs for ngnix and traefik, but not Apache since about July. There’s a few threads on it:

Can't connect via Apache reverse proxy

I’m trying to configure access to HA on my local network at home.myhouse.local. I’m following the instructions outlined in the post Reverse Proxy with Apache, and I’m not having any luck connecting at all. When I complete the setup in per the article, I get a DNS_PROBE_FINISHED_NXDOMAIN error. My environment: I’m running HA Supervised with Ubuntu I also haven’t configured SSL yet; it’s on my to-do list, but for now I’m just trying to get up and running through a port 80 proxy. I’m using avah…

Reverse Proxy with Apache

I’m 110% sure that my HA is running on the 192.168.1.1 address. I can access it with http://192.168.1.1:8123 and it works nicely. But I want to close a port from the internet to the HA and thus I need to use Apache and some kind of proxy configuration. I’ve already created certificates for my public static ip but the HA is not running on that machine. That’s why the proxy. Can you please share your complete apache2 -config if possible that is working atm?

Update broke Apache Reverse Proxy

what does your configuration.yaml section for http look like?

In that thread, people are adding their reverse proxy based on an IP being blocked from the logs, I don’t have any log entries about a proxy being blocked.

[SOLVED] Serve HA via Apache questions

Hi, I have now been following along a bunch of tutorials on how to setup apache reverse proxy for HA. I have not succeeded with any config and was hoping to get some help from you, the experts, as you have got it running. My setup is as follows: I have home assistant installed on my ubuntu server running in a docker container. I have a reverser proxy configuration using apache2. This is all working. I can access my websites, services and home assistant from my local network (home assistant …

I have exactly the same issue with the wss to /api/websocket being blocked, however proxy_wstunnel is already enabled.

Serving home assistant via Apache reverse proxy

What kind of configuration would I have to do nin HA? So far I have done nothing to it and it still is working locally. When I am hitting the domain in the browser I get the login screen and can type username and password. When trying to login after that the screen turns black and I get the HA Logo in the middle of the screen saying underneath: Unable to connect to Home Assistant. Underneath that message is a button that just says: Retry. It releoads the page. When looking into the logs I can s…

This whole /api/api thing didn’t change anything.

I documented my Apache config here back in April, and since then I’ve updated my config to allow both my proxy host IP AND the entire /24 subnet of the proxy, no good:

Help understanding how to host this with SSL?

This was more complex than I thought, so I want to document what I did here. Much was taken from here: https://www.digitalocean.com/community/tutorials/how-to-acquire-a-let-s-encrypt-certificate-using-dns-validation-with-acme-dns-certbot-on-ubuntu-18-04 First, I had a single virtualhost in apache before for *:80, I made another virtualhost for “hass.domain.com” with the following config: <VirtualHost *:80> ServerName hass.example.com Redirect permanent / https://hass.example.com/ </Virt…

[wisekki (AnttiK)]

I’m using this and it works for me anyway. Home Assistant is running on host 192.168.1.1 at default port 8123. One of the problems why it didn’t work at first was the end slashes. For some reason they’re pretty mandatory(?) Also modules like these are required:

• mod_proxy
• mod_rewrite
• mod_http
• mod_headers

<VirtualHost *:443>
    ServerName ha.domain.co
    SSLEngine on
    SSLCertificateFile	/etc/letsencrypt/live/domain.co/fullchain.pem
	SSLCertificateKeyFile /etc/letsencrypt/live/domain.co/privkey.pem
			
    ProxyPreserveHost On
    ProxyRequests Off
    ProxyPass /api/websocket ws://192.168.1.1:8123/api/websocket
    ProxyPassReverse /api/websocket wss://192.168.1.1:8123/api/websocket
    ProxyPass / http://192.168.1.1:8123/
    ProxyPassReverse / http://192.168.1.1:8123/
    
    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteRule ^/?(.*) "ws://192.168.1.1:8123/$1" [P,L] 
</VirtualHost>

[hulkhaugen]

I was led to this thread, but i’m just feeling more confused now. My setup was working just fine (HassOS, NGINX Proxy Manager) until a few days ago when i got a new phone. I got to the login screen, but my login attempt was refused. Also upgraded my PC to Win11, and it also got rejected. I found a “hack” that works, but not for long i suppose, as i added the remote IP range (Cloudflare: 162.158.222.0) to the thrusted proxies. I think my problem is that i have ip_ban_enabled: true also. As I read the documentation, the use_x_forwarded_for: true will forward the remote device/service IP to HA, instead of the reverse proxy’s IP. But in that case, I would have to enable all possible IP ranges that Cloudflare might use in my case, and that seems counter-intuitive. If I understand this correctly, I don’t see any practical way of combining ip_ban_enabled and a reverse proxy. Or am I misunderstanding this?

[adrian_ha]

I am relatively new to Home Assistant and have installed Nginx for a separate requirement on a separate Raspberry Pi 4 in a docker container. I am having the same issues as discussed above and attempted different trusted IP addresses with no luck at all.

I can get to the login page but after login I get a message “Unable to connect to Home Assistant”

The log indicates: 2022-01-16 15:11:16 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 110.xxx.xxx.xxx (110.xxx.xxx.xxx). (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Edg/97.0.1072.55)

Seems like the Nginx is not allowing the authentication to pass through to HA?

I would appreciate any ideas or pointers.

[koying (Chris B)]

Likely, you didn’t configure nginx properly for websockets.

[nicolas.s.shu (Nick S)]

In case you’re using Nginx Proxy Manager, make sure that you’ve enabled the Websockets support on your subdomain

[fahadshery]

This fixed all my web issues but I can’t make it work on the iOS.
Getting NSURLErrorDomain - 1003 error when tried to connect via the App on an iPhone

[fschade (Floor)]

Weird, if have read everything, and configured it properly, but i still get ERR_CONNECTION_REFUSED.

All other reverse proxy rules are working. So it must be something with HA.

[mwav3 (Tim)]

Home Assistant relies on websockets, which basically are a “stay open” type of connection, and requires extra configuration on the reverse proxy side to allow websockets to work. Which proxy are you trying to use?

To rule out the block issue on the Home Assistant side, you can TEMPORARILY add this to your config:

http:
    use_x_forwarded_for: true
    trusted_proxies:
      - 0.0.0.0/0 

This will completely open the Home Assistant block and allow any reverse proxy to go through. If this works then the issues is not specifying the right IP for the trusted proxy. If it still doesn’t work even after allowing all IPs, the issue is on your reverse proxy configs and likely not on the Home Assistant side (likely not configuring websockets properly). I say Temporarily set this only for testing because leaving it like this overrides the security and leaves your system vulnerable to attacks, which is the reason specifying this IP was added as a requirement last year.

Update:
Took another look at your post and possibly its just a YAML formatting issue. Move the IP to another line and indent it with a dash instead of putting it right after the colon. Try this instead of what you have:

http:
    use_x_forwarded_for: true
    trusted_proxies:
      - 192.168.178.whatever

[fschade (Floor)]

@mwav3 , thanks for helping out. With this setup i have the same result:

Same issue with these settings:

these are the reverse proxy settings:

[mwav3 (Tim)]

That appears you are using the NGINX proxy manager - if so checkout this post. You need to go to advanced settings and specify additional info. This user was able to get it working successfully with the config they posted

Nginx Reverse Proxy Set Up Guide – Docker

Below are some screenshots on how to get to the Advanced section I was referring to. (I don’t post much so pardon this messy post if it doesn’t come through right, ha). [image] [image] [image] You may notice I commented out the resolver line, I’m not sure that was necessary but I think it prevented the proxy from coming back online in my particular case. The final screenshot doesnt show all the text in that advanced box but my previous post has all the text that I put in there. Hope this…

[fschade (Floor)]

@mwav3 , thanks again. i don’t use a NGINX reverse proxy. I use the standard build in reverse proxy from synology.

All the setting they are talking about are not in here or in a different location.
What do you use as a reverse proxy?

[mwav3 (Tim)]

I’m not too familiar with synology, but I know it’s more locked down then just running on a Linux os like Ubuntu or debian.

I use the SWAG docker container, which sets up nginx and some other tools like ssl and fail2ban. I’m running it on Ubuntu.

GitHub - linuxserver/docker-swag: Nginx webserver and reverse proxy with php...

The thread I linked in the last post contains a comprehensive setup guide. Pretty sure you can run docker containers on synology, but it might be a little different from the guide. Guide is in the top post (linked below)

Nginx Reverse Proxy Set Up Guide – Docker

In light of the recent “hacking” stories, last week I set myself the goal of implementing Nginx. I read most related posts in this forum and elsewhere, but was unable to find a step by step guide for “enthusiasts” with limited it skills. Therefore I proceeded to do it the hard way: read, trial and error. Regretfully the forum was of no use as some of the individuals with “apparent subject matter experience” chose to offer condescending advice with no real benefit or substance. I do, however, w…

[fschade (Floor)]

@mwav3 thanks again. i will check this setup, but it seems a bit of big change for something that should work with the syno reverse proxy. But many thanks for your help!

[aldihome (Leon)]

I have HA in a docker container on a raspberry pi.
I use remote.it to proxy my network, since I could not edit port forwarding of the router.
SSH works flawless, but I am having problems accessing the web interface.

I added

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.0.0.1

to my config, but now I am getting Received X-Forwarded-For header from an untrusted proxy 127.0.0.1

I saw in this thread, that deleting proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; is the only solution (but with security risk?). But where can I edit my nginx, since I am using remote.it?

This is my config there:

EDIT: Guess it was just a typo. Thanks @w35l3y