MSR with reverse proxy

[tunnus]

I'm trying to use MSR via reserve proxy in Synology DSM, but MSR page does not load

https://<public ip>:30000/reactor/en-US/

At the same time logging page loads normally

https://<public ip>:30000/api/v1/log

I thought maybe authentication was messing it up, but there was no deny entries in the log, and also disabling authentication did not make any difference. For this use case VPN is not an option (that works, but as said not an option for this particular use case).

Any ideas what could cause this? MSR build latest-26242-28d69aa8, Chrome browser

[toggledbits]

Do you have baseurl set in your config?

[tunnus]

@toggledbits yes I have

baseurl: "http://<private ip>:8111"

[toggledbits]

Yeah, that will likely be a problem. It will try to redirect to that private IP and find itself unable. The API calls to the public IP don't need to do this, but the UI interfaces very much do. You might try putting the public IP there.

[tunnus]

@toggledbits if I’d put public IP there, would it still work as expected when UI is used without a proxy? Also, does it accept dns name or just IPs?

[toggledbits]

@tunnus said in MSR with reverse proxy:

if I’d put public IP there, would it still work as expected when UI is used without a proxy?

That's a routing/firewall issue. Some will do it out of the box, some you have to enable it (it's often called NAT loopback, NAT hairpinning, or NAT reflection).

@tunnus said in MSR with reverse proxy:

Also, does it accept dns name or just IPs?

It should. That may be another path for you -- internal DNS resolution gives the local address, while external give the public address.

Caution all around, though. I don't build or test this for use in such proxies. I can foresee issues with access control in your scenario, because there's a high probability of extra steps needed to "see through" the proxy to the real original requesting address. If it works for you, fine, but at the moment, I'm not inclined to do more on this.

[therealdb]

I use it with synology in this exact way. This is only resolved by my own dns running on my unifi. I have local entries in my laptop to resolve to my static ip. Even https/was are ok.

[tunnus]

@therealdb although I used only IP addresses and not dns names, I wasn't able to get UI to load. In my setup I'm using MSR in a docker container network and not host networking, so that might cause some additional headaches.

So could you share your configuration (e.g Synology reverse proxy conf, baseurl ...)? Obviously no need to use real IPs. I'm also wondering if https configuration in MSR can be avoided (not using that at the moment), but using let's encrypt cert in DSM. Port forwardings & firewall settings shouldn't be an issue, as /api/v1/log page works fine.

(MSR itself being in a container network having 172.18.0.11 address)