Reverse proxy through Synology

Configuration
43

Perhaps using trusted_proxies, possibly together with use_x_forwarded_for.

44

I have trusted proxies entered, IP’s are IP of NAS segment and those two which are stated in virtual machine: 172.30.0… and 172.17…
use_x_forwarded_for is set to true. doesn’t work…

45

If you’re trying to access HA “inside my local network with local HA IP”, as you say, how does that relate to the reverse proxy setup?

46

So, i have external access set-up via Synology reverse proxy, so i access to it via, say, “homeassitant.mydomain.synology.me”. For local acces i would use local IP of my HA setup, so, say, 192.168.0.200:8123.

What i would like is this:

  • if i enter “homeassitant.mydomain.synology.me” → username and password is asked
  • if i enter “192.168.0.200:8123” → i go directly to HA lovelace, without entering username/password.

If i understand THIS PAGE correctly this should be possible, but it doesn’t work for me…

47

And you’re using a configuration similar to this?

auth_providers:
  - type: trusted_networks
    trusted_networks:
      - 192.168.0.0/24

(assuming that you’re accessing 192.168.0.200 from an IP address in the range 192.168.0.X)

48

Yes. I also tried to add other IP segments, as stated in Syno’s virtual machine (as said above: 172.30.0… and 172.17.0…), but i always get computer is not allowed.

49

I’m not too familiar with Synology VM’s (I mainly use Docker, and the times I did use a VM it got an IP address from my router, so in the 192.168 range that all my local computers use), but where does the mapping between the 192.168.0.200 and the internal VM address range (172.X) take place?

50

I guess that it happens inside Synology’s virtual machine manager. But, there must be either some other IP involved…

51

Then I’m out of ideas :frowning: In any case though, it doesn’t sound like your issue is related to the reverse proxy.

1 Like
52

Hi @mirekmal
just a question about the “important to understand” portion of your guide, would it make any difference setting up a docker reverse proxy like nginx proxy manager instead of using the out of the box provided reverse proxy? or is it the same thing security wise? The fact that docker is using a bridge network instead of my LAN’s subnet makes it hard for me to understand the differences, if any, since i am not a network expert.
Thanks.

53

Desosav, I believe Synology Reverse proxy is under the hood actually nginx, as entire Synology DSM is linux based… It just has nice UI integrated into DSM. So Security wise it should not make any difference. Stll traffic is secured up to edge device (proxy server) and once enters the LAN it connects to target device same way. Difference while using docker based proxy is that there is additional layer of NAT between LAN (e.g. 192.168.x.y) and internal docker network (172.30.32.x, if I’m not mistaken).

1 Like
54

Hi Guys
In my case I could not access (error 400) because I had not added the docker network gateway (in my case 172.18.0.1):

http:
  use_x_forwarded_for: true
  trusted_proxies: 
  - 192.168.1.100 # IP my NAS
  - 172.18.0.1 #docker network gateway  "docker-brigde"
1 Like
55

Hi and thanks for you explanation!

I’m unfortunately always getting 400 errors and tried each ip address for trusted_proxies which can be found in this thread as well as the ip of my NAS which runs the proxy server.

Any idea how I would find the correct IPs to list here?

Thanks!

56

I only have NAS IP configured for trusted_proxies:

http:
  use_x_forwarded_for: true
  trusted_proxies: 192.168.52.21 # IP of my NAS

I have HA configured as VM running on ESXi host and never needed to add docker bridge to config…
So hard to say what might be wrong here :frowning:

57

After a lot googling, this simple solution fixed my external access to my HA on synology! I’ve had everything setup correctly but was getting the “unable to log in” error.

58

You may need to modify your configuration file. Regarding the certificate from Let’s Encrypt, you’ll need to make sure that it’s properly installed and configured for the subdomain. If the certificate isn’t properly installed, your integration may not work as expected. You may receive security warnings. Besides, you’ll have to configure your reverse proxy in DSM to use the certificate for the subdomain for HA. Make sure that the reverse proxy is properly forwarding requests to the HA server. I hope I helped. This method worked when I was trying to do the same thing. However, my proxies from https://shiftproxy.io/pricing-isp were a bit different from yours. But I hope it will work for yours too.

59

Certificate is in this case installed in Synology (under security -->certificate), not in HA. Synology accesses HA through proxy with local IP and http.

60

Hi, I am also using my Synology as a reverse proxy for HA, but the last time I am experiencing issues. Sometimes HA pages are not loading or generating errors. This also happens with the add-on pages. It used to work flawless before. Now I am thinking of using haproxy or something else.
Is there anyone that has a similar experience?

61

If have switched to haproxy and that is much, much faster. My issues have gone away now.

62

Where did you install haproxy?