[solved] "Unable to connect to Home Assistant" from WAN (Duck DNS + NGINX)

Installation Home Assistant OS
68

port forward on router: External port 443, internal port 443 → Raspberry ip.

Hassio config:
External URL https://domain.duckdns.org
Internal url http://homeassistant.local:8123

You confirm? Reset your raspberry before trying

69

I confirm port forward on router (external 443>internal 443>Raspberry Pi HA IP), the URLs listed in yor update, and bounce of the HA RPI. Still experiencing the same issue.

Note that I did not include duckdns.org in the domain of the NGINIX configuration. Does this match what you’ve done?

Thanks again!

70

Sure you should set it in
domain: customdomain.duckdns.org

Leave other settings as they are
443 host and 80 disabled)

71

That was it! NGINIX domain must be: customdomain.duckdns.org, and I had previously used the domain as listed in duckdns.org only (without duckdns.org).

Thank you!!!

72

Many are having issues. Documentation should be more clear

73

…and something so simple!

74 
http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.33.6       #Remote LAN 
    - 192.168.1.XX    #Your Home assistant IP only
  ip_ban_enabled: true
  login_attempts_threshold: 5

This is the the working solution for me!!!
Thanks a lot @JorgeMoreira you solved a nightmare!

75

Till you have a reboot and it decides that 172.30.33.5 is the new address and it won’t work anymore. I have been caught with this.

I think the range 172.30.33.0/24 is better.

4 Likes
76

I just changed my router setup which now includes a reverse proxy for my HA. I failed to login to HA the usual way and got the error in the log:

Logger: homeassistant.components.http.forwarded
Source: components/http/forwarded.py:112
Integration: HTTP (documentation, issues)
First occurred: 07:12:02 (8 occurrences)
Last logged: 07:12:17

A request from a reverse proxy was received from 192.168.44.34, but your HTTP integration is not set-up for reverse proxies

I found the documentation and this thread. I added this to the configuration.yaml:

http:
  use_x_forwarded_for: true
  trusted_proxies:
     - 192.168.44.34
  ip_ban_enabled: true

Rebooted and tried again. I still get the HA logo and a retry link.
My router is forwarding all traffic on port 80/443 to my server running the reverse proxy. The server running the proxy handles the SSL certificate and forwards to [my HA local IP]:8123.

What have I missed?

1 Like
77

are you using a docker or HA OS?

78

Sorry! I’m now running HA OS, 2021.10.6.

79

Are you using ports in your domain?

80

No. My external url is something like this: ha.mydomain.com
In my reverse proxy I map https://ha.mydomain.com to http://[my HA local IP]:8123

81

I found the problem. HA needs websocket activation in the reverse proxy. After activating that in the proxy it works as expected.

Sorry for bothering you. Hopefully someoner else learned something from this. I did at least.

1 Like
82

How do you manage ngix in HA? I have no websocket option…

83

I’m running the reverse proxy on my NAS which handles this.

1 Like
84

Thank you. I had to reinstall NGINX and I was hitting the same thing without realizing that I hadn’t properly created the connections in the proxy manager.

85

I have been looking for a solution in OPNsense / HA for the same issue whole morning, this solved it! Thanks!

1 Like
86

Hi all,
I had problem with connecting to HA from reverse proxy on apache.
After typing username/password i got: “Unable to connect to Home Assistant”
My setup:
VPS with external IP, apache reverse proxy, Open VPN server -------- HA, VPN client

I found solution on: https://stackoverflow.com/questions/27526281/websockets-and-apache-proxy-how-to-configure-mod-proxy-wstunnel

It had to enable websocket in apache virtualhost config.

sudo a2enmod proxy rewrite proxy_http proxy_wstunnel

Here is my apache config:

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName your_server_name
    ServerAlias www.your_server_name


    # Enable the rewrite engine
    # Requires: sudo a2enmod proxy rewrite proxy_http proxy_wstunnel
    # In the rules/conds, [NC] means case-insensitve, [P] means proxy
    RewriteEngine On

    # socket.io 1.0+ starts all connections with an HTTP polling request
    RewriteCond %{QUERY_STRING} transport=polling       [NC]
    RewriteRule /(.*)           http://your_ha_ip_address:8123/$1 [P]

    # When socket.io wants to initiate a WebSocket connection, it sends an
    # "upgrade: websocket" request that should be transferred to ws://
    RewriteCond %{HTTP:Upgrade} websocket               [NC]
    RewriteRule /(.*)           ws://your_ha_ip_address:8123/$1  [P]

    ProxyPreserveHost On

    ProxyPass / http://your_ha_ip_address:8123/
    ProxyPassReverse / http://your_ha_ip_address:8123/

    
    ErrorLog ${APACHE_LOG_DIR}/your_server_name.error.log
    CustomLog ${APACHE_LOG_DIR}/your_server_name.access.log combined

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/your_server_name/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/your_server_name/privkey.pem
</VirtualHost>
</IfModule>

Maybe it will help for someone.

2 Likes
87

Thank you. I couldn’t figure out the cause of the problem with OPNsense. You saved me a few more hours of scrolling through posts

1 Like