Nethsec / WebSocket support

NethSecurity
22

Hi,

I’m new to NethSecurity and I’m facing websocket issue too.

I tried to add proposed configuration below :

root@homerouter:~# cat /etc/nginx/conf.d/ns_132e9cbd.proxy 
location / {
  proxy_http_version 1.1;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_set_header Host home.custom.host;
  client_max_body_size 1024m;
  resolver 127.0.0.1;
  proxy_pass http://$upstream;
  allow 192.168.0.0/24;
  deny all;
  set $upstream 192.168.1.111:8123;
  list proxy_set_header 'X-Forwarded-Proto $scheme'
  list proxy_connect_timeout '7d'
  list proxy_send_timeout '7d'
  list proxy_read_timeout '7d'
  list proxy_buffering 'off'
  list proxy_buffer_size '64k'
  list proxy_buffers '8 64k'
  list proxy_busy_buffers_size '128k'
}

But when I execute either nginx-proxy-gen or /etc/init.d/nginx restart custom config is lost.

root@homerouter:~# cat /etc/nginx/conf.d/ns_132e9cbd.proxy 
location / {
  proxy_http_version 1.1;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_set_header Host home.custom.host;
  client_max_body_size 1024m;
  resolver 127.0.0.1;
  proxy_pass http://$upstream;
  allow 192.168.0.0/24;
  deny all;
  set $upstream 192.168.1.111:8123;
}

My home network is organized around 2 LANs. My provider box and NethSecurity. Today I have a RPI with Home Assistant connected to the LAN of the box which I like to join from NethSecurity LAN with the same domain name as outside my home network.

NethSecurity WAN is plugged in DHCP on the box provider LAN.

The network configuration is :

  • My provider box LAN on 192.168.1.0/24
    • Home assistant
    • NethSecurity
  • NethSecurity LAN on 192.168.0.0/24
    • NAS
    • Personal computer
    • …

I have a domain name “custom.host” which resolves sub-domain “home.custom.host” to my provider IP address.

I try to reverse proxy “home.custom.host” with NethSecurity LAN to RPI directly. With the default configuration I have a websocket issue.

[edit] : An error occurred: Sorry, new users can only put one embedded media item in a post.

Console Firefox → Firefox ne peut établir de connexion avec le serveur à l’adresse wss://home.custom.host/api websocket.

Network Tab Firefox → NS_ERROR_CONNECTION_REFUSED

Is it me that made a misconfiguration of the reverse proxy ?

[edit] : An error occurred: Sorry, new users can only put one embedded media item in a post.

Domain

Domain : home.custom.host

Certificate : Self sienged machine certificate

Destination URL : http://192.168.1.111:8123

Allowed networks : 192.168.0.0/24

It is specified that reverse proxy only works for HTTPS, but in which way redirect HTTPS to HTTP or the other way around ?

Thanks for your help.

23

You need to edit /etc/config/nginx and add your custom config, see https://dev.nethsecurity.org/packages/nginx/#configuration
I recommend to backup the file because if something goes wrong you can’t reach the web UI anymore.

Redirection from HTTP to HTTPS is always enabled.

24

Thank you for your reply, indeed, I was editing the wrong file.

But it didn’t resolve my issue :sweat_smile: .

I think there were 2 problems :

  • I had to clean site data, because the (old) certificate wasn’t the same which is used bay NethSecurity.
  • I had to create a DNS entry to redirect the hostname to the router itself
    home.custom.host → 192.168.0.1

Now it’s working :blush: