Connect to Zabbix through reverse proxy

cazz · May 4, 2020, 7:57pm

NethServer Version: 7.7.1908
Module: Zabbix

When I access the zabbix with IP inside my network https://192.168.1.14/zabbix then I have no problem to login and work with my zabbix server.

But when I trying to access it from my domain that go through a reverse proxy https://subdomain.domain.se and then trying to login it say

You are not logged in

You must login to view this page.

If you think this message is wrong, please consult your administrators about getting the necessary permissions.

I running a nethserver with web server as reverse proxy.

michelandre · May 4, 2020, 8:57pm

Hi CJ,

Maybe…

Access for green and red networks for ports 10050 and 10051

# config set fw_zabbix service status enabled TCPPort 10050,10051 access green,red


# signal-event firewall-adjust

Verification

# cat /etc/shorewall/rules | grep 1005*
ACCEPT  loc     $FW     tcp     10050
ACCEPT  net     $FW     tcp     10050
ACCEPT  loc     $FW     tcp     10051
ACCEPT  net     $FW     tcp     10051


# config show fw_zabbix
fw_zabbix=service
    TCPPort=10050,10051
    access=green,red
    status=enabled

Michel-André

Andy_Wismer · May 4, 2020, 8:59pm

@cazz

Hi

Is Zabbix running on your NethServer?

Reverse Proxy has two modes: Folder-Redirect (eg /zabbix/ ) or Domain-Redirect (eg zabbix.mydomain.com ).

I use both forms of redirect with the Reverse-Proxy in NethServer, depending on target. I also let NethServer (usually) handle the SSL via LetsEncrypt.

However: If your NethServer is running Zabbix (As per available module) AND also happens to be your reverse-proxy, then: No Reverse Proxy is needed.
Simply access your Nethserver as follows:

https://nethserver.mydomain.com/zabbix

Note: I use variants as:

https://intranet.mydomain.com/zabbix

these work well too!

My 2 cents
Andy

Andy_Wismer · May 4, 2020, 9:00pm

@michelandre

Hi

I think he’s trying to access the Web Front-End (GUI), not open the Zabbix Ports to the Internet or LAN.

My 2 cents
Andy

michelandre · May 4, 2020, 9:04pm

Hi André,

I agree.

Michel-André

cazz · May 4, 2020, 9:13pm

@michelandre
yes that is the GUI I trying to access

@Andy_Wismer
Yes I use domain-redirect on my proxyserver

My network is build so with a proxyserver (nethserver) takes care of all traffic that come from my domain and also take care of my cert from LetsEncrypt. It send the user to the right server I have on my server park dependent on what domain and subdomain it use. All my service works like it should like guacamole,web server, webmail and some other service.

Andy_Wismer · May 4, 2020, 9:14pm

@cazz

Try using folder redirect, should be sufficient for Zabbix…

cazz · May 4, 2020, 9:22pm

@Andy_Wismer
Why not, can be interesting to see if it works.
Going to try that tomorrow, have to read a little about it because I have never done that in nethserver and not sure how to do that.

Andy_Wismer · May 4, 2020, 9:23pm

@cazz

Is Zabbix running on the same NethServer as your Reverse-Proxy?

Reverse proxy with folder only work if the folder isn’t in use on that server, eg /zabbix…

cazz · May 5, 2020, 3:52pm

@Andy_Wismer

No every system have it own Nethserver.

Andy_Wismer · May 5, 2020, 3:57pm

@cazz

Reverse Proxy should still work…
I don’t assume you have several Zabbix servers (one, well planned, is enough!).
So the /zabbix/ would only be available on the Zabbix server, not on the Reverse Proxy.
Note: The Zabbix Agent does not use a web interface…

My 2 cents
Andy

See also here:
https://docs.nethserver.org/en/v7/ui/ProxyPass.html

cazz · May 6, 2020, 4:49pm

mm I have done that too so I have to dig in a little in this weekend to see what is wrong.

Andy_Wismer · May 6, 2020, 4:55pm

@cazz

Hi

I’d try

allow http & https on the zabbix server.
use an unencrypted connection from your reverse proxy to your Zabbix server. quite often differing SSL certs ARE a bigger issue than expected…

Andy

cazz · July 29, 2023, 1:51pm

Hi again
This is a old topic but still same problem.
Last time I gave up and stopped using Zabbix. But a friend of mine wants to use it and unfortunately I’m stuck in the same place again. But I have found something that might shed some light on the problem. When I activated the guest account on Zabbix, I can log in but it logs in as a guest so it seems like the proxy doesn’t understand that it is an account it is trying to log in but as a guest account.
So it seems I need to add something to the config file for proxy but not sure what.