Messages

1

24.7 Production Series / [solved]Issue with my nginx reverse proxies after updating to 24.7.1

« on: August 08, 2024, 04:48:16 pm »

Edit: Solved.. sorta. Issue found!
After doing more testing I found out my issue was that the opnsense had issues retrieving geo ip for a geolocation block rule. This started happening after last update.
Somehow this made it so that it blocked all countries instead of the ones I set up in the settings.
Disabling that rule allows my reverse proxies to work untill I fix or find the cause of the geo ip issue

Issue:
Using the nginx plugin in which ive made a good few http servers -> Location and then the 2 upstream parts.. default reverse proxies
My reverse proxies are not able to be reached anymore by domain URLs. Neither form the outside nor the inside.
The only way it does work from the INSIDE is to put domains in Unbound DNS Overrides and refer them to any of my LAN interface gateways.
Firewall does not show any blocks, neither does Zenarmor.
Everything worked fine (domains were reachable from outside as well as inside my network simply with  the nginx plugin) at 24.7_9 .. only after 24.7.1 it stopped working.
There is nothing in front of my OPNsense.

Any ideas?

2

Zenarmor (Sensei) / Re: ZenArmor 1.17 broken Live sessions view from Blocks report tab

« on: April 24, 2024, 02:17:25 pm »

Can confirm this. While I never used it myself I can at least say that this seems to not work as intended atm.

3

General Discussion / Re: nginx plugin - waf policy issueissue

« on: March 27, 2024, 03:28:28 pm »

Welp, if anyone finds this thread.
Not solved the initial issue, but made it bearable by simply having all the stuff enabled on the main domain and then create Basic Rules to whitelist the IDs that kept blocking stuff. (regardless of the location of the policy trying to block it and whether its active on either domain/subdomain or both)

4

General Discussion / nginx plugin - waf policy issueissue

« on: March 22, 2024, 10:07:22 am »

So.. basically I have my nginx like this. Simple reverse proxy for a main website that is the domainname and then a few sites that contain a subname.domainname... nothing special.


Now I have been turning on and editing WAF policies to make sure its all fully secured, but im walking against an issue.
WAF policies active on the main domain name are blocking stuff happening on the subdomainnames within nginx.

So lets say it like this.. sub2.domainname.com has issues with something due to the SQL injections policy of WAF. I then turn off only the SQL injections policy for sub2.domainname.com. It still gets blocked.
However when I then also turn off the SQL injections policy on the domainname, it works.
In the logging I can see that rules/policies only active on the domainname site also seem to block stuff on the subdomains.

How can I try to seperate it so that WAF rules from the main site dont affect the subdomains (which are totally seperate sites)?

5

General Discussion / Re: Need help in regards to nginx plugin setup

« on: January 26, 2024, 11:43:51 am »

As additional info ... http access logs dont actually show anything for the last few hours regardless of me opening the website on multiple devices.
When I turn off nginx however, none of the websites are available so not sure how/where it is actuallly allowing in the other subdomains

6

General Discussion / Need help in regards to nginx plugin setup

« on: January 26, 2024, 09:55:14 am »

Good day,

There is no doubt that I am doing something wrong, but I would like to figure it out.
I used to use the reverse proxy on my Synology NAS which basically was an extremely simple UI whereby you point 1 thing to another
Due to the fact that im setting up some services on another device as well I imagined the best way to handle this is  reverse proxy it from the router.

Now.. ive used the tutorials online to at least set up a basic setup, however I am running into an annoying issue already. Even though at http server ive got the servername set to aaa.domain.com, it also proxies domain.com, bbb.domain.com etc. etc. so basically.. all the other subdomains as well.

My setup right now looks like this:
httpserver


location:


Upstream:


Upstream server:


traffic stats screen:


firewall rule:


I also have Unbound set up with all the subdomains so I could access them from inside LAN. Not sure if that influences anything.

So basically wondering why its proxying more than im telling it to?

Any general tips on setting it up with a good few subdomains that will need to be directed to different IPs would be appreciated as well.

If I figure anything out in the meantime ill be sure to update.

7

General Discussion / Re: Trying to access my opnsense gui through WAN interface

« on: January 18, 2024, 03:17:10 pm »

If you go to Interfaces -> WAN there should be the option: Block private networks. Any chance thats turned on?
That basically blocks LAN IPs to do anything with the WAN port.