[BUG] AutoTLS hosts on wrong addresses #1578
Comments
|
I can't get this working whatsoever. I get the following error trying to access the server locally: And accessing the server remotely gives me |
|
Hello @AlbinoGeek please check my reply on your previous issue as I am reading this new one |
|
I think that it a log "issue", indeed the server is running on http:...:443 when accessing the https://...:80, the errors you got in your console maybe result of localhost testing instead of a domain or no? AutoTLS works on a linux (ubuntu) and windows systems here, can you give me more information please? |
|
This may require #1577 to be solved first, as this is using As per more information: It is fairly common in my experience for an HTTP server behind this sort of proxy/NAT to still function (just without the SSL portion) on testing domains such as |
|
This binds to :80 because of the automatic HTTP -> HTTPS server, the @AlbinoGeek I think you can close this issue now? |
|
I can close #1577 , but not this issue. This issue remains as a bug in the logging that shows |
|
Alright, after speaking with @kataras a bit, here's what we've come to:
For case 1) The server is correctly listening on For case 2) The same logic as case 1 should apply, but is not currently. In regards to |
|
Now when using Thanks @AlbinoGeek, your issue and contribution was one of the best we've ever had! |
kataras
added
the
good first issue
|
This aaaaaaaaaaalmost works, just one more change (messaged you on git) Lines 410 to 412 in 0edf0af This is the only remaining blocker on my NAT situation. |
|
@AlbinoGeek These lines are commented out (and the host:port part fixed), give it a shot |
|
Commits up to and including ff5e43f have fixed this! However, due to the way golang/crypto works, external port 80 cannot be changed, this is not iris fault. For anyone who finds this in the future (I'm going to PR an example), the following code works: SolutionThis allows a system where NAT or Port Forwarding creates the following rules to host iris. Firewall RulesDebian 9 or older, # Forward internal 8443 to external 443
sudo iptables -t nat -A PREROUTING -p tcp --dport 8443 -j REDIRECT --to-ports 443
sudo iptables -t nat -A OUTPUT -p tcp --dport 8443 -j REDIRECT --to-ports 443
# Forward internal 8080 to external 80
sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j REDIRECT --to-ports 80
sudo iptables -t nat -A OUTPUT -p tcp --dport 8080 -j REDIRECT --to-ports 80
## You may also need to run this, if it's not working:
## echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
## and once it's all working, you need to save the firewall rules, or it's lost on reboot:
## iptables-saveDebian 10 or newer, # Enable Port Forwarding
sudo firewall-cmd --zone=external --add-masquerade
# Forward internal 8443 to external 443
sudo firewall-cmd --zone=external --add-forward-port=port=443:proto=tcp:toport=8443
# Forward internal 8080 to external 80
sudo firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toport=8080
## For added security, add ":toaddr=127.0.0.1" to the end of each of the above lines:
## sudo firewall-cmd --zone=external --add-forward-port=port=443:proto=tcp:toport=8443:toaddr=127.0.0.1
## sudo firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=127.0.0.1
## Then, change `internalHost` to "127.0.0.1" below
## And again, once it's working, save the rules so they're not lost on reboot:
## sudo firewall-cmd --runtime-to-permanentWorking Codepackage main
import (
"fmt"
"net/http"
"time"
"github.com/kataras/iris/v12"
"github.com/spf13/pflag"
)
var (
adminEmail = pflag.String("admin-email", "[email protected]", "Administrator email sent to LetsEncrypt")
domain = pflag.String("domain", "example.com", "Canonical domain for URL generation")
externalHost = pflag.String("external-host", "0.0.0.0", "HTTP(S) Hostname used externally")
internalHost = pflag.String("internal-host", "0.0.0.0", "HTTP Hostname used internally")
internalPortPlain = pflag.Int("internal-port", 8080, "HTTP Port used internally")
internalPortSecure = pflag.Int("internal-port-secure", 8443, "HTTPS Port used internally")
)
func main() {
pflag.Parse()
app = iris.New()
app.Get("/", func(ctx iris.Context) {
ctx.JSON(map[string]interface{}{
"time": time.Now().Unix(),
})
})
tlsAddr := fmt.Sprintf("%s:%d", *internalHost, *internalPortSecure)
domains := fmt.Sprintf("%s www.%s your.%s", *domain, *domain, *domain)
app.Run(iris.AutoTLS(tlsAddr, domains, *adminEmail, iris.AutoTLSNoRedirect(fallbackServer)))
}
// Without this, the ACME HTTP-01 challenge would fail
func fallbackServer(acme func(http.Handler) http.Handler) *http.Server {
srv := &http.Server{
Addr: fmt.Sprintf("%s:%d", *externalHost, *internalPortPlain),
Handler: acme(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
http.Redirect(w, r, fmt.Sprintf("https://%s/", *domain), iris.StatusTemporaryRedirect)
})),
}
go srv.ListenAndServe()
return srv
}Test it's working# Test Internal plaintext ip/port
$ curl http://localhost:8080
<a href="https://example.com/">Temporary Redirect</a>.
# Test external plaintext ip/port
$ curl http://example.com
<a href="https://example.com/">Temporary Redirect</a>.
# Test external secure ip/port
$ curl https://example.com
{
"time": 1597304304
} |
|
Good job @AlbinoGeek! If we can dockerize this example and put it on https://github.com/kataras/iris/tree/master/_examples/http-server as |
Describe the bug
Using the example AutoTLS code results in
http://localhost:443outputUsing AutoTLS code for
0.0.0.0:443results inhttp://0.0.0.0outputTo Reproduce
Steps to reproduce the behavior:
0.0.0.0:443Expected behavior
AutoTLS hosting on
https://0.0.0.0in both casesScreenshots
Desktop (please complete the following information):
iris.Version
The text was updated successfully, but these errors were encountered: