maciekish

Very little chance of exposing something by accident? Last time i checked, a VPN exposes the entire network. Unless you configure it for specific hosts only. Which also requires configuration and knowledge, just like a reverse proxy. A reverse proxy on the other hand, only exposes a single http service. Both don't let any traffic through to the target service until you authenticate with a client certificate.

Really? Generate a CA cert and add this to Caddy. Done. (defaults) { @exclude-paths { not path /plugins/* not path */plugins/* not path /logging.htm } encode @exclude-paths { gzip 7 zstd } log { output file /var/log/caddy/access.log { roll_size 20MiB roll_keep 5 roll_keep_for 720h } } } (client-auth) { tls { client_auth { mode require_and_verify trusted_ca_cert_file /mnt/user/appdata/caddy2/ca.crt } } } domain.name { import defaults import client-auth reverse_proxy * http://10.0.1.0 } VPNs require explicit connecting, and even stateless protocols like Wireguard have issues when you roam between unstable connections. Suddenly it just doesn't work when it still shows connected. With Caddy and split DNS i can just type in the same URL on any of my devices from anywhere in the world and access anything on my home network. Been running this exact config for over 5 years with zero issues. Can't say the same about VPNs.

Hi can you please add WD160EDGZ?

I can confirm the new setting to allow custom networks to communicate with host fixes the issue.

Any news on this please? I need it also.

For future reference the issue is due to "buffering" in gzip in Caddy. Workaround: gzip { not /plugins }

As a matter of fact, i never got the answer "no". And even if you would said no, you cannot answer for everybody. Maybe someone else would be able to help. You made your suggestion and i wasn't interested. Why continue forcing it on me?

I respectfully disagree. It is a arguably easier to set up a password-only PPTP VPN than a reverse proxy as this is built-into for example Windows-Server and provides a point-and-click UI to do it. Incorrectly configured VPN and reverse proxy will both be equally insecure. Correctly configured VPN and reverse proxy will both be equally secure. I was asking if anyone knows why a small part of the web ui doesn't work and instead i'm being lectured on security... Gee, thanks.

I don't understand this witch hunt on reverse proxies. They can be made to require client certificates as well just like a VPN has a private key or a certificate, encrypt their traffic like a VPN and don't pass anything through to unRAID until authentication has been satisified. And im not the only one to want this

Admin, please delete/lock this thread. This conversation is absolutely useless.

What is with the attitude on this forum? I asked a simple question which could even be a well known issue. I don't mind suggestions. I politely refused because it is not suitable for me, yet it was forced upon me in the next post, that is my problem with all this.

I didnt ask what the most secure solution is. Please leave the security to me. I want to know why it doesnt work over a reverse proxy and how to fix it.

You are not helping. I have reported these posts.

The webGUI isnt exposed until you login. Anyone can attempt to login to your VPN as well.