Messages

1

Web Proxy Filtering and Caching / Re: Nginx Banning Local IP Issues

« on: August 11, 2024, 10:46:55 am »

Hi
Have you tried to exclude 'okhttp' from Bots User Agents at Global HTTP Settings?

2

23.7 Legacy Series / Re: NGINX no resolver defined

« on: August 03, 2024, 02:34:28 pm »

Hi
the specified resolver can be used not only by ssl_stapling, so I wanted to leave the possibility of more fine-tuning than specifying it at the global level. (there is a http_post/*.conf hook at the global level. Advanced users can define a global parameter with it).

Maybe it would be a good idea to set the resolver to "127.0.0.1, [::1]" for a HTTP Server if "None" is selected to mitigate the unnescessary warnings in the log.
my logic is - if the message bothers, the user can configure the resolver. if not - user can always filter the logs and not show messages below the error level. I don't think it's the best idea to substitute the resolver value without the user's knowledge 

3

23.7 Legacy Series / Re: NGINX no resolver defined

« on: August 02, 2024, 06:21:36 pm »

Hi!
sorry, have you assigned this resolver to the server with this LE cert?

4

General Discussion / Re: NAXSI WAF Configuration Not Applying

« on: July 27, 2024, 10:38:44 pm »

Hi.
It is necessary to create WAF rule(s), combine them into WAF policie(s) and assign policies to Location(s).
Has this been done?

5

24.1 Legacy Series / Re: PHP Fatal Error - nginx/tls_ua-fingerprint.php

« on: July 13, 2024, 05:45:17 pm »

https://github.com/opnsense/plugins/pull/4092

6

24.1 Legacy Series / Re: PHP Fatal Error - nginx/tls_ua-fingerprint.php

« on: July 12, 2024, 09:54:10 pm »

@franco
thanks again!

@ealbright
there is no "disable handshake logging" checkbox yet in 1.33 (a little busy and didn't have time, sorry)
i will try to add it and make a pr asap (I hope it's a quick-fix)

7

24.1 Legacy Series / Re: NGINX - Duplicate Locations

« on: July 07, 2024, 08:41:03 am »

"Enable Let's Encrypt Plugin Support" enabled at Server settings and then a configured location added also?

8

24.1 Legacy Series / Re: PHP Fatal Error - nginx/tls_ua-fingerprint.php

« on: July 07, 2024, 08:33:27 am »

Hi
https://github.com/opnsense/plugins/issues/3854

9

23.7 Legacy Series / Re: Nginx -> HTTP server -> Real IP Source

« on: May 28, 2024, 06:01:26 pm »

Hi.
-These headers are intended to show the client where the original server/proxy resides in a heterogeneous systems
I still don’t understand why you think using an XFF header in the '<arbitrary_external_server_address>, $proxy_add_x_forwarded_for' format satisfies the standard way if it assumes the '<client>, <proxy1>, <proxy2>' format.
if there was no NAT in front of the nginx, the external address of the plugin would also not be included in this header

-No, I can't. You are talking about some abstract suggestion..
It would be more accurate to say not a non-standard header, but non-standard requirements?

-Does it survive the update/upgrade of OPNsense? I mean -- is this a standard way for OPNsense?
This is certainly not the preferred method (preferably all settings are available in the UI) but it is included in the plugin templates. and yes, it will survive the reboot\update\upgrade.

I'm not a plugin maintainer, so feel free to ignore my assumptions  I just believe that changes requests should be motivated and I understand that I would not come up with enough justification for the maintainer to accept my arguments in this case

10

23.7 Legacy Series / Re: Telegram Notifications

« on: April 12, 2024, 02:13:49 pm »

Hi
i think the quickest way to do this with the $SERVICE monit variable:
change "Service name" to something like "My_server_check" and
change Telegram message template ('Message' field with 'Advanced mode' enabled in Telegram settings) to something like:

Code: [Select]

<b>DATE:</b> {MONIT_DATE}
<b>HOST:</b> {MONIT_HOST}
<b>SERVICE:</b> {MONIT_SERVICE}
<b>DESCRIPTION:</b>
<pre>{MONIT_DESCRIPTION}</pre>
to include this variable to message

11

Web Proxy Filtering and Caching / Re: Reverse Proxy Nginx with Subdomain

« on: March 30, 2024, 04:17:54 pm »

Hi
I’m not sure that I fully understand, but if you want to do this through GUI, you will have to make two servers:
x1.domain.io
x2.domain.io
(upstream may be left alone)
To add a folder to URL, you can add two rewrite rules like:
rewrite ^(/zs/ef/x/)(.*) $1x1/$2 last;
rewrite ^(/zs/ef/x/)(.*) $1x2/$2 last;

and add them to the appropriate servers.
but I'm really not sure I understood the intent correctly

12

Web Proxy Filtering and Caching / Re: NGINX Naxsi and Nextcloud Webdav

« on: March 26, 2024, 08:32:07 am »

https://github.com/opnsense/plugins/pull/3678 ?

13

Web Proxy Filtering and Caching / Re: Nginx Proxy - Real IP

« on: March 21, 2024, 08:26:42 pm »

yep, backend server should treat ip from XFF as a client IP )
settings depend on the server

14

23.7 Legacy Series / Re: system -> settings -> administration save fails

« on: March 21, 2024, 08:24:11 pm »

what does "not intended for server use " even mean?

https://www.ssl2buy.com/wiki/what-is-the-difference-between-client-and-server-certificates

when you hit Save button GUI cert key usage extension is checked

15

Web Proxy Filtering and Caching / Re: Nginx Proxy - Real IP

« on: March 21, 2024, 08:10:59 pm »

Hi
Reverse proxy uses XFF (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For) header to pass this info to the backends.
traffic flow is not entirely clear in your case