Hi,
I am using OPNsense 21.7.7-amd64 in a Lab Enviroment.
to make the Web GUI available from outside I have set up an external reverse Proxy to connect to the GUI.
I have set Alternate Hostnames accordingly and I am able to log into the GUI.
Strange thing is ... I am missing some parts of the configuration altough I am logged in with root.
e.g. Settings for the ACME client are missing: Plugin is disabled, no account is defined, etc.
If I log in with the same user locally (not using the external reverse proxy) ... I can see the full config Plugin is enabled, account is set up, etc.
I am pretty new to OpnSense .... Can anybody give me a hint ?
Hi
you can try to look in proxy logs and browser dev console. may be some api calls are blocked
Thnx for your reply !
I checked with browser console and it gives the following error:
scheme
https
host
reverse.domain.com
filename
/api/core/menu/search/
_
16545493428251
Adresse
217.154.123.111:443
Status
401
Unauthorized
VersionHTTP/1.1
Übertragen239 B (48 B Größe)
Referrer Policysame-origin
menu.search : Unauthorized
So I guess this means that you r right and API calls are blocked.
I cannot see anything unnormal in the logs of the Reverse Proxy.
Is OPNSense blocking these calls ?
What can I do to prevent it from doing so ?
is your reverse proxy requires authentication?
if so try to not pass Authorization header to opnsense host
It turns out you are right again.
I have configured my reverse proxy with Basic Authentication:
<Proxy *>
Order deny,allow
Allow from all
Authtype Basic
Authname "Password Required"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
# SetEnv proxy-chain-auth
</Proxy>
So i gues the problem is that Authentication headers are passed to OpnSense.
Once I remove Basic Authentication on the Reverse Proxy everything works just fine.
Can anybody give me a hint on how to not passing the Authorization header ?
looks like Apache? sorry, not using it. but google is full of answers )
like https://serverfault.com/questions/707889/how-to-stop-apache-https-reverseproxy-passing-basic-auth-to-tomcat