User Tools
Site Tools
Trace:
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| app-notes:webvpn-secure-https-portforwardings-for-unsecure-http-devices [2018/07/13 12:14] – preisig | app-notes:webvpn-secure-https-portforwardings-for-unsecure-http-devices [2022/01/28 14:00] (current) – schmitt | ||
|---|---|---|---|
| Line 6: | Line 6: | ||
| ===== Concept ===== | ===== Concept ===== | ||
| - | < | + | {{: |
| The above shows the basic concept of such an infrastructure. In the end you want to be able to reach your unsecure HTTP Endpoints (industrial facilities, measurement devices, webcams et cetera) through the internet on a secure basis. Your routers will be part of a secured OpenVPN network and from the internets point of view requests get in and out of your environment through https. Once they reach the container they get forwarded as http requests, but through your secured network to the acutal endpoint. This environment can be setup combining OpenVPN and a service called [[https:// | The above shows the basic concept of such an infrastructure. In the end you want to be able to reach your unsecure HTTP Endpoints (industrial facilities, measurement devices, webcams et cetera) through the internet on a secure basis. Your routers will be part of a secured OpenVPN network and from the internets point of view requests get in and out of your environment through https. Once they reach the container they get forwarded as http requests, but through your secured network to the acutal endpoint. This environment can be setup combining OpenVPN and a service called [[https:// | ||
| Line 12: | Line 12: | ||
| ===== Prerequisistes ===== | ===== Prerequisistes ===== | ||
| * Netmodule Router running software version >= 4.0.0.100 with a virtualisation licence | * Netmodule Router running software version >= 4.0.0.100 with a virtualisation licence | ||
| - | * Running LXC virtualisation environment [[app-notes:virtualisation|described here]] | + | * Running LXC virtualisation environment [[virtualisation:start|described here]] |
| * ARM based linux distribution of your flavor from [[https:// | * ARM based linux distribution of your flavor from [[https:// | ||
| * The [[https:// | * The [[https:// | ||
| - | * As an alternativ you can download a ready to use container | + | * As an alternativ you can download a ready to use container |
| * OpenVPN network setup (your container could also run on one of your openvpn clients) | * OpenVPN network setup (your container could also run on one of your openvpn clients) | ||
| * Clients need fix IP adresses so you can add them later to traefik | * Clients need fix IP adresses so you can add them later to traefik | ||
| Line 24: | Line 24: | ||
| Setting up traefik is fairly simple. The main concept of how the service works is shown in the following graphic: | Setting up traefik is fairly simple. The main concept of how the service works is shown in the following graphic: | ||
| - | < | + | {{: |
| + | (image taken from traefik.io) | ||
| You have to define entrypoints (where http and https) traffic is incoming with the option to redirect between them. The next step is to setup frontends which define routes from entrypoints to backends depending on a set of rules (modifiers: that modify a request, matchers: determin if a particular request should be forwareded or not). At the end is the backend which represents on or more http servers (the endpoints). | You have to define entrypoints (where http and https) traffic is incoming with the option to redirect between them. The next step is to setup frontends which define routes from entrypoints to backends depending on a set of rules (modifiers: that modify a request, matchers: determin if a particular request should be forwareded or not). At the end is the backend which represents on or more http servers (the endpoints). | ||
| Line 39: | Line 40: | ||
| [entryPoints] | [entryPoints] | ||
| [entryPoints.http] | [entryPoints.http] | ||
| - | address = ": | + | address = ": |
| + | [entryPoints.http.redirect] | ||
| + | entryPoint = " | ||
| [entryPoints.https] | [entryPoints.https] | ||
| address = ": | address = ": | ||
| + | [entryPoints.https.auth.basic] | ||
| + | users = [" | ||
| [entryPoints.https.tls] | [entryPoints.https.tls] | ||
| Line 108: | Line 113: | ||
| </ | </ | ||
| + | The example configuration builds on the image from the concept earlier. We would realise the following: | ||
| + | * Site1 | ||
| + | * Router OpenVPN client ip: 10.8.0.6 | ||
| + | * HTTP Endpoint will be reached through: https:// | ||
| + | * Site2 | ||
| + | * Router OpenVPN client ip: 10.8.0.10 | ||
| + | * HTTP Endpoint will be reached through: https:// | ||
| + | * http and https are allowed as entrypoints, | ||
| + | * Basic authentication trough MD5 encoded password (done with htpasswd) for user: test | ||
| + | * [[https:// | ||
| + | * The example config would get certificates for example.com but you can also provide SAN's (alternative domains) to the main one. | ||
| + | For a more detailed description on how to configure traefik please refer to [[https:// | ||
| + | ==== Information on the already setup container ==== | ||
| + | You can download traefik already integrated into an[[https:// | ||
| + | |||
| + | Download from: **(ADD LINK AGAIN)** | ||
| + | * Configuration: | ||
| + | * Binary: / | ||
| + | * Startup Script: / | ||
| + | |||
| + | In this container all you need to do, is extract it to your router, edit / | ||
| + | |||
| + | Since the service runs as non-root user the default listening ports for http and https where changed to 65080 and 65443. So additionally on your router you'd need to create NAPT Rules, that rewrite the http & https ports accordingly. | ||
| + | |||
| + | {{: | ||
| + | |||
| + | |||
| + | ===== Configuring the router (EndPoint) ===== | ||
| + | |||
| + | On the router side we assume that you have already setup OpenVPN. Now in the configuration above you saw, that the backends are defined with the OpenVPN ip adresses but not using the standart http port 80 instead they are configured via 8080. This is simply, because you might have more then one EndPoint in your site which then makes assigning them via the same router very easy. Just increas the port number on the defined backends in traefik. | ||
| + | |||
| + | The Router (for example in Site1) would need a NAPT Rule translating the incoming Port 8080 from its tun interface to port 80 and the ip of your endpoint. So your NAPT rule on the router on site 1 might look like this (with a second endpoint to visualize the just mentioned). | ||
| + | |||
| + | {{: | ||
| + | |||
| + | |||
| + | On the router that is running the container and serving the requests, don't forget to change the WebGui Ports 80 & 443 to some other ports,so that they can be re-written via NAPT rules to get to the container. | ||