OTP/2FA not working with Reverse Proxy

[ed.j]

I have managed to set up a reverse proxy, which I am loving. However I can't log into DS Video / Files / Finder apps (on Android) using accounts that have OTP generated by an authenticator app (I use Authy but I presume this is irrelevant).

I have tested this by disabling 2FA on a certain account and it will let me log in, but as soon as I turn on 2FA it just keeps asking for codes as if I've entered it incorrectly.

On browsers the log in works properly.

I have tried resetting the OTP mechanism for the accounts by disabling and re-enabling but it doesn't fix anything.

Any ideas please? I'm a big fan of 2FA and don't want to have to turn it off, especially for admin accounts.

Many thanks...

 

[ed.j]

Strangely I have found that if I use the address with the final DSM port in the reverse proxy address, it works - I thought the whole point of reverse proxy was that the subdomain was associated with a port DSM side?

So with 2FA, rev.mydomain.com:5001 works whereas rev.mydomain.com does not work. Either works without 2FA.

Am I doing something incorrectly? Family members use DS Video and some use 2FA, and it's so much cleaner (and satisfying) to just give them a simple address rather than one with a port after it...

 

[Rusty]

Mobile apps need to have ports added even if it's the default port for that protocol (like 443 for https). Syno design.

 

[fredbert]

Mobile apps need to have ports added even if it's the default port for that protocol (like 443 for https). Syno design.

Don't the older DS apps assume the default ports 5000 and 5001 if a port number is omitted?

It's just easier to always add the port number in these apps.

 

[Rusty]

Don't the older DS apps assume the default ports 5000 and 5001 if a port number is omitted?

I think you are right... but in any case, the good thing is the "remember" option. So I don't even pay attention to it tbh.

 

[ed.j]

Thanks for the responses guys, however I can't entirely agree for two reasons - I am probably misunderstanding though!!

Again this is all when using a reverse proxy.

1. The port is only required when using 2FA
2. Isn't the whole point of a reverse proxy that the app doesn't define the port, the reverse proxy does?

 

[fredbert]

When you use rev.mydomain.com:5001 you are actually bypassing the reverse proxy and going straight to the DSM web portal (on port 5001, if that's what you use) and the API it uses to access the required package.

But using rev.mydomain.com:443 will use the reverse proxy (well Application Portal), because it is listening to port 443.

I just tested and rev.mydomain.com failed while rev.mydomain.com:443 worked, and rev.mydomain.com: DSM_HTTPS_PORT threw a certificate mismatch (I use different certificates for different services).

I can't recall if the newer mobile apps don't require the port number but the older apps* are very finicky about it. Just add ':443' to the server name, if that's the port you use.


*the apps you listed are in the older category.

 

[Nefe]

I have managed to set up a reverse proxy, which I am loving. However I can't log into DS Video / Files / Finder apps (on Android) using accounts that have OTP generated by an authenticator app (I use Authy but I presume this is irrelevant).

I have tested this by disabling 2FA on a certain account and it will let me log in, but as soon as I turn on 2FA it just keeps asking for codes as if I've entered it incorrectly.

On browsers the log in works properly.

I have tried resetting the OTP mechanism for the accounts by disabling and re-enabling but it doesn't fix anything.

Any ideas please? I'm a big fan of 2FA and don't want to have to turn it off, especially for admin accounts.

Many thanks...

I have tried hard in settings up the reverse proxy without avail. How did you managed to set up a reverse proxy mate? Step by step instructions will be very much appreciated ([email protected])

 

[Telos]

I just tested and rev.mydomain.com failed while rev.mydomain.com:443 worked, and rev.mydomain.com: DSM_HTTPS_PORT threw a certificate mismatch (I use different certificates for different services).

Alternately, you can forward 443 to the NAS, and the domain works w/o adding the port.

 

[ed.j]

When you use rev.mydomain.com:5001 you are actually bypassing the reverse proxy and going straight to the DSM web portal (on port 5001, if that's what you use) and the API it uses to access the required package.

But using rev.mydomain.com:443 will use the reverse proxy (well Application Portal), because it is listening to port 443.

I just tested and rev.mydomain.com failed while rev.mydomain.com:443 worked, and rev.mydomain.com: DSM_HTTPS_PORT threw a certificate mismatch (I use different certificates for different services).

I can't recall if the newer mobile apps don't require the port number but the older apps* are very finicky about it. Just add ':443' to the server name, if that's the port you use.


*the apps you listed are in the older category.

You are right - using :443 worked, and with 2FA, which was my initial issue. Thanks!

Alternately, you can forward 443 to the NAS, and the domain works w/o adding the port.

This doesn't work for me - with 2FA anyway. Simply says it cannot connect.

I have tried hard in settings up the reverse proxy without avail. How did you managed to set up a reverse proxy mate? Step by step instructions will be very much appreciated ([email protected])

my own notes as follows.
I have a feeling that the destination should be http rather than https - but on my side I have DSM http forwarding to https anyway so I'm not sure it makes a difference.

SSL / HTTPS cert always needs domain name, either bought or DDNS
Numerical IP doesn't work

DDNS: Log In - No-IP

TO GET HTTPS / SSL CERT WITH REVERSE PROXY

1. Ensure there is "A" record on website pointing subdomain eg "vpn" if vpn.xxx.uk to nas external IP (88.xxxx)

Each subdomain requires new certificate

1. DSM-Control Panel-Login-Advanced-Reverse Proxy

Source HTTPS / vpn.xxx.uk / 443 (should always be 443 for https Reverse Proxy )
Destination HTTPS / 192.168.1.174 / appropriate service port

1. On router forward port 80 to 80 on dsm
2. On DSM open port 80
3. DSM-Control Panel-Security-Certificate-Add
4. Close ports on router and DSM