Access Netbox with external proxy

[Pivebq]

Hi.

Recently I discover Netbox and I installed it to test and is wonderfull, I want to try it but I encountered a little problem for my installation and I have a proxy wth all my SSL certificate for all my sites that are hosted in a backend web server and now I have Netbox in a third server.

The thing is that I can't access from outside to Netbox because it always want to use SSL and I receive the config pache of Apache2 of the Netbox server, the only way I have to access is from my LAN using the IP address istead from outside using my subdomain (netbox.domain.com).

My external proxy is working fine becaus it redirects the communication the the netbox server, all changes that I made in index.html default Apache2 page are shown but not the Netbox.

My netbox.conf in netbox server is:

<VirtualHost *:80>
    ProxyPreserveHost On

    # CHANGE THIS TO YOUR SERVER'S NAME
    ServerName netbox.domai.com:80
    ServerAlias netbox.domain.local:80 # Active directory domain but I can access either like this

#    SSLEngine on
#    SSLCertificateFile /etc/ssl/certs/netbox.crt
#    SSLCertificateKeyFile /etc/ssl/private/netbox.key

    Alias /static /opt/netbox/netbox/static

    <Directory /opt/netbox/netbox/static>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Require all granted
    </Directory>

    <Location /static>
        ProxyPass !
    </Location>

#    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
#    ProxyPass / http://127.0.0.1:8001/
#    ProxyPassReverse / http://127.0.0.1:8001/
</VirtualHost>

In my external proxy server the netbox sites is configure as:

<VirtualHost *:80>
        ServerName netbox.domain.com
        ProxyPreserveHost On
        DocumentRoot /var/www/html
        ProxyPass /.well-known !
        ProxyPass / http://10.0.1.212:80/
        ProxyPassReverse / http://10.0.1.212:80/
        ServerAdmin [email protected]
</VirtualHost>

Now all is configured with insecure http because I need to work like that between proxy and Netbox machine, after it works I'll install Let's Encrypt certificate in proxy server.

I do all this because if not I can't have a certificate in my proxy for netbox and another one for same Netbox in Netbos server renewed autocamically (for certbot, I hace to redirect 80 and 443 ports only to a host that is the proxy server).

Does anyone give some help?

Thanks.

EDIT:

My system is Linux Debian 11 Bullseye X64 running on a Proxmox Virtual Machine, 2 Core CPU, 2048 MB RAM and 8GB HDD

[candlerb]

Firstly, please edit your posting to put three backticks on a line of their own (```) before and after the config. This will defeat the Markdown rendering and make them render as plain text. In particular, it's very hard to see what lines you have commented out.

Secondly: state your platform (e.g. Ubuntu etc). There may be some other enabled virtual host listening on port 80, which is returning the default page.

From outside, try accessing https://netbox.domain.com/badpath and look at the 404 error carefully - it may tell you which host is returning it, either the outside proxy or the Netbox proxy server.

Finally: there is a known problem with Django and proxy chaining; Django can't understand X-Forwarded-Host with multiple entries. But that should result in a Netbox error, not the Apache default page (so you have to fix the other problems first). When you have fixed those, then on the outer proxy I use:

ProxyPreserveHost On
ProxyAddHeaders Off
RequestHeader set X-Forwarded-For "expr=%{REMOTE_ADDR}"
RequestHeader set X-Forwarded-Proto "https"

[Pivebq]

I've comment that trying to find the error bur when I try to access to netbox.domain.com I have the index.html of the Apache from the netbox machine. To test it I changed the index.html for a simple html page with Welcome on Netbox Apache and I get that not the Netbox system. If I use a LAN PC and try to acces via IP address of Netbox I can get inside.

[candlerb]

when I try to access to netbox.domain.com I have the index.html of the Apache from the netbox machine

And as I said, that's because you removed these two essential lines of config:

     ProxyPass / http://127.0.0.1:8001/
     ProxyPassReverse / http://127.0.0.1:8001/

Without these, Apache will answer with local pages only, and not proxy to Netbox.

[Pivebq]

Hello.

I set uncomment those two lines and I get Bad Request (400) when trying to connect to netbox.domain.com. If I try con connecto to netbox.domain.com/badpath I get same response from server. If I comment those lines I get the default Apache web page. Then, I'm sure I'm going to the Netbox server.

[candlerb]

What does the body of the 400 Bad Request response show?

[Pivebq]

Hi.

It says nothing more than Bad Request (400).

The only I achieved is to access using NAT from external port redirecting to Netbox machine IP and port 8001. For this I had to modify the netbox.conf and set the ProxyPass and ProxyPassReverse to http://10.0.1.205:8001/ instead http://127.0.0.1:8001/ as original.

If I try to access through proxy I get only a Bad Request (400). If I try to access through proxy to domain.com/static I get the list of files of directory.

[Pivebq]

Hi. Removing those comments Apache dices not start.

…

-------- Mensaje original -------- De: Brian Candler ***@***.***> Fecha: 24/4/22 12:55 (GMT+01:00) Para: netbox-community/netbox ***@***.***> Cc: Pivebq ***@***.***>, Author ***@***.***> Asunto: Re: [netbox-community/netbox] Access Netbox with external proxy (Discussion #9207) when I try to access to netbox.domain.com I have the index.html of the Apache from the netbox machine And as I said, that's because you removed these two essential lines of config: ProxyPass / http://127.0.0.1:8001/ ProxyPassReverse / http://127.0.0.1:8001/ Without these, Apache will answer with local pages only, and not proxy to Netbox. — Reply to this email directly, view it on GitHub<#9207 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AA3N5DU6TVG4VSUCW45GIBTVGUSANANCNFSM5UELVPYA>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[candlerb]

Then that's a different problem to the one you described before: you now have a syntax error somewhere in your Apache config.

Look at the output from:

journalctl -eu apache2
tail -20 /var/log/apache2/error.log

and it may tell you where the error is.