Oh Painful BitWarden_RS...

Currently reading
Oh Painful BitWarden_RS...

45
13
Last edited:
Hi All

BitWarden was supposed to be easy... It was easy. And then it wasn't.
So, before Christmas, following the advice on these boards, I setup my Bitwarden_RS as per the Rusty guide. It worked and was good. I had a problem with the usual https access, but solved it somehow. However, I did nothing with this container; I couldn't get fail2ban working and this seemed to me to be a necessary step. So I wasted several full days over the last couple of months with the sosandroid pages trying, in vain.

Yesterday I gave up and tried to resurrect my working container from before, except it wouldn't. I can access with my local address and port, but I couldn't login due to this https thing again. This time I cannot resolve the problem, even using RP and my day off work is again lost.

Tonight I decided to start again and following the Rusty article I again created a container. On first run I cannot create an account, due to https I guess. So I download an old version of Firefox and then create my account.
Now, using the old Firefox, I can log in with my local address. Using a current version of Firefox it will not work.
My Let's Encrypt is apparently good and chained (comodosslstore.com), although my RP address (bitw.mydomain.com) only gives me the Synology not found page, whether I try from within my network or without.

I am so lost. What am I screwing up??? (I feel such a plonker rewriting what others have written in synoforum and many times elsewhere, but I cannot find my solution in those...)
Thanks.
 

Attachments

  • reverse proxy.png
    reverse proxy.png
    25.2 KB · Views: 23
  • summary.png
    summary.png
    31.3 KB · Views: 23
357
67
NAS
RS820+, DS718+
Operating system
  1. Windows
Mobile operating system
  1. iOS
Check the firewall. Temporarily disable it, does it then work? Also use https:// then your bw domain name
 
Upvote 0

Rusty

Moderator
NAS Support
3,416
1,014
www.blackvoid.club
NAS
DS718+, DS918+, 2x RS3614RPxs+
Router
  1. RT1900ac
  2. RT2600ac
  3. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
From the images it all looks ok. That error would indicate that when you reverse to you https url, there is nothing there.

The fact that local access works this has to be rp problem of some sort.

Try using localhost as a destination address in your reverse proxy.

Also, do you have the correct DOMAIN variable set for the container pointing to your public name?
 
Upvote 0
45
13
Last edited:
Check the firewall. Temporarily disable it, does it then work? Also use https:// then your bw domain name
Hi Gerard
Thanks for the thoughts. I had tried the Syn firewall, makes no difference. I have port forward and firewall rules in my USG as attached.
-- post merged: --

From the images it all looks ok. That error would indicate that when you reverse to you https url, there is nothing there.

The fact that local access works this has to be rp problem of some sort.

Try using localhost as a destination address in your reverse proxy.

Also, do you have the correct DOMAIN variable set for the container pointing to your public name?
Hi...
Yes, my money would have been on the RP. Except I have a RP setup for DSM and that was working fine.

The DOMAIN variable is inside, yes. See screenshot. I must have removed it when I took the first screenshot.

Five minutes later... so localhost works??? Why? How? I never use localhost, I always use my local fixed address. So that is not the reason it worked before...
Please... Explain...
I thank you, but explain... (I will not marked Solved yet...)
 

Attachments

  • LAN IN.png
    LAN IN.png
    6.3 KB · Views: 10
  • PortForward.png
    PortForward.png
    6.3 KB · Views: 13
  • summary.png
    summary.png
    37.9 KB · Views: 12
  • certif.png
    certif.png
    15 KB · Views: 13
Upvote 0

Rusty

Moderator
NAS Support
3,416
1,014
www.blackvoid.club
NAS
DS718+, DS918+, 2x RS3614RPxs+
Router
  1. RT1900ac
  2. RT2600ac
  3. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
Five minutes later... so localhost works??? Why? How? I never use localhost, I always use my local fixed address. So that is not the reason it worked before...
Please... Explain...
The reason is that if you use an IP address the container will start to "look" around your network and then terminate back to your NAS.

If you have docker containers on multiples NAS you would use IP, but if the container runs on the device that is also an RP, localhost works.

Reason IP does not work out of the sudden could be routing.
 
Upvote 0
45
13
Could be a DNS problem before then DHCP
Ignore that remark of mine, it was nonsense... I had changed the RP back to the local address, then it stopped working again. Surprise.

The reason is that if you use an IP address the container will start to "look" around your network and then terminate back to your NAS.
Yes. That would imply routing as you said. I take your point about containers on multiple NAS (in my case, one NAS is sufficient for Docker! Already in over my head I think.) although that nonetheless suggests that localhost is a workaround that is "sufficient" in my case. I need to think about the routing and how I could screw up a visit to the switch (same vlan) and back. Thanks.
 
Upvote 0

Rusty

Moderator
NAS Support
3,416
1,014
www.blackvoid.club
NAS
DS718+, DS918+, 2x RS3614RPxs+
Router
  1. RT1900ac
  2. RT2600ac
  3. MR2200ac
Operating system
  1. macOS
Mobile operating system
  1. iOS
Ignore that remark of mine, it was nonsense... I had changed the RP back to the local address, then it stopped working again. Surprise.


Yes. That would imply routing as you said. I take your point about containers on multiple NAS (in my case, one NAS is sufficient for Docker! Already in over my head I think.) although that nonetheless suggests that localhost is a workaround that is "sufficient" in my case. I need to think about the routing and how I could screw up a visit to the switch (same vlan) and back. Thanks.
Log into your NAS as root and try and run these commands one at a time then restart your NAS

Code:
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
 
Upvote 0
357
67
NAS
RS820+, DS718+
Operating system
  1. Windows
Mobile operating system
  1. iOS
Could it be due to docker using its own network? When i was going thru the setup the container was running off a 172.x.x address rather than my local ip subnet of 192. I use localhost for my rp rules and never had a problem. Peak around the network tab and check the ip subnet of docker/docker container.
 
Upvote 0
45
13
Log into your NAS as root and try and run these commands one at a time then restart your NAS
Hi Rusty,
I did this and no great change. I can access Bitwarden inside and outside my network. This would be great, if I could get fail2ban working, although this eludes me still.
What I had before was that I had access inside the network. If I was outside, I could VPN inside and access Bitwarden from there. i.e. not possible to get access without VPN. This must be more secure. Does anyone have this without using Caddy?

Hi Gerard, yes, Docker will supply a 172... by default. I have my own network defined, to help with security a little.
 
Upvote 0
357
67
NAS
RS820+, DS718+
Operating system
  1. Windows
Mobile operating system
  1. iOS
I can access Bitwarden inside and outside my network. This would be great, if I could get fail2ban working, although this eludes me still.

Im now confused, did i miss something. I thought this whole thread was about bitwarden not working outside of the network?
 
Upvote 0
45
13
Im now confused, did i miss something. I thought this whole thread was about bitwarden not working outside of the network?
Partially! In the first post, I had the situation that using the my domain address bitw.mydomain.com I couldn't log in, whether inside or outside the network. I CAN do this now. This is a step forward. (Having to have localhost in the RP puzzles me though. The pic that shows the local IP¨address for one RP and localhost required for the other is plain weird to me. Utterly unimportant I suppose, but weird. This suggests I still haven't got a clue and I don't like that feeling!)
All I need now is someone who has made fail2ban work and I'll be a very happy camper... I do not have IDS/IPS and exposing THE most important database in my life to a potential brute force attack (yes, I have got 2FA) does not make me feel good.

Hope I haven't sown too much additional confusion!
 

Attachments

  • ReverseP.png
    ReverseP.png
    7.6 KB · Views: 5
Upvote 0
357
67
NAS
RS820+, DS718+
Operating system
  1. Windows
Mobile operating system
  1. iOS
All I need now is someone who has made fail2ban work a

Probably should start a new thread and provide information and screenshot regarding that particular setup.

Unfortunately no information regarding that specific setup is provided, therefore its kind of difficult to provide guidance atm.
 
Upvote 0

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Similar threads

Welcome to SynoForum.com!

SynoForum.com is an unofficial Synology forum for NAS owners and enthusiasts.

Registration is free, easy and fast!

Trending threads

Top