Subdomains (and also with reverse proxy) always display the DSM login page on DSM 7.2.1

[kartashov.al.and]

Hi all!

Please help me, I've tried everything and I'm at a loss for ideas

My setup

DS224+, DSM 7.2.1-69057 Update 3

Installed apps (no 'Web Station')

I added a repo https://packages.synocommunity.com/ to install community packages. 'Syncthing' and 'Gitea' are installed from it

'Security' configuration

---

---
Firewall was disabled for testing:

---

---

---
Checkout configurations for 'Certificate' below
---

---

SSO Client disabled

'Network' configuration

---

---

---

---

'External Access' configuration

'Login Portal' configuration

---
Checkout configurations for 'Applications' below
---

Port forwading on router

All HSTS (http->https redirects) toggles are disabled for tests.


Problem #1

Subdomains for syno applications and reverse proxy not working.

If I create an alias for the Synology Photos:

everything works as expected, app available on:

• https://myaccount.synology.me/photos
• http://myaccount.synology.me/photos
• https://synologynas:5001/photos
• http://synologynas:5000/photos

App also available on ports 80 and 443 with lan-domain (I don't know why, but let it be):

• https://synologynas/photos
• http://synologynas/photos

But if I enter "Customized domain":

then always DSM login page opened:

If we go to any other 4th level domain, we get exactly the same result:

screenshot

In other words, the "Customized domain" didn't affect anything - DSM login page opens on any level 4 subdomain.

The same thing happens if I configure reverse proxy. Syncthing for example (which runs on port 8384):

Syncthing

---

---

There's nothing wrong with the certificates

I'm at a loss. Maybe it's because of level 4 domains? And everything will work fine on level 3 domains?


Problem #2

If I make a "Customized domain" on DSM tab to "myaccount.synology.me":

then this page will always return 404:

Subdomains continue to (not) work as described above.

Maybe I'm missing something? What is this setting for?

 

[Gerard]

Two things:

1) Do you have port 443 forwarded from your router to the synology 443?

2) to use dms with reverse proxy, under login portal go to advanced. Create an https dsm rp item. Source would be https 443 and then it’s routed to localhost 5001

Let’s see if we can get just that bare minimum to work first.

 

[Rusty]

The same thing happens if I configure reverse proxy. Syncthing for example (which runs on port 8384)

Why are you port forwarding 443 to your 5001 internal port? Just port forward it to 443 as well. nginx (internal reverse proxy) is running on 80/443 alongside 5000/5001 (btw you should change these for security purposes ASAP) so there is no need to map 443 to 5001, but rather 443 to 443 if you want to use reverse proxy records.

 

[palasjai]

Did you restart your web server after implementing all your changes in subdomain and reverse proxy?

 

[Gerard]

The problem is you don’t solely make the port changes in customized port under local portal -> synology photos. By you entering https port 5443 there that means the photos service is running on port 5443 and not reverse proxy of 443.

Entering the customize port there without doing the reverse proxy setup means you’d have to enter your domain name:5443 but you don’t have that port forwarded on your router to your nas; nor would you want it set this way if you want to use reverse proxy.

There’s one port forward from router to nas for reverse proxy. Forward 443 on router to 443 nas. Then go into login portal, advanced, and select reverse proxy to create your rp entries. Now if you used some sort of customized port this is where you need to enter that too. So for photos you set 5443 as custom port, create a rp line source 443 to local host 5443 and it should work.

picture yourself a communication line. Typing in a subdomain sends to request to your public ip/domain name over 443. 443 request of this domain name hits the router and says send it to the nas because nas is the one that’s directing this where to go. The rp name matches photo.domain on 443 which then says hey send it to 5443, which then sends it to the app.

 

[kartashov.al.and]

1) Do you have port 443 forwarded from your router to the synology 443?

so there is no need to map 443 to 5001, but rather 443 to 443 if you want to use reverse proxy records.

OMG! I finally realized my mistake!
5000/5001 ports is only for DSM, they're not shared to all the other applications.

Forwarding 80 to 80 and 443 to 443 on router solved all the problems described above!

And I didn't even have to follow this recommendation:

2) to use dms with reverse proxy, under login portal go to advanced. Create an https dsm rp item. Source would be https 443 and then it’s routed to localhost 5001

Gerard, Rusty thank you very much!

Did you restart your web server after implementing all your changes in subdomain and reverse proxy?

Yes, nginx restarted automatically (or reload configs) when the appropriate settings is saved - any changes I made to the settings had an immediate effect.

By you entering https port 5443 there that means the photos service is running on port 5443 and not reverse proxy of 443.

I didn't change the default ports for the app - the specified ports in the inputs in my screenshots above are html's <input /> placeholder, not the actual value.
But thanks for your explanation!


But I have a couple more questions, if you'll excuse me

1.

nginx (internal reverse proxy) is running on 80/443 alongside 5000/5001 (btw you should change these for security purposes ASAP)

Do you mean override ports 5000/5001?
If so, why? DSM on these ports is only available on the internal network. Or am I missing something?
If you mean 80/443, that was the original point - not to specify ports when typing the address.


2. I failed to set up automatic http->https redirection in "Reverse Proxy" settings.

Any of "HSTS"-checkboxes works as expected (for consistent reproducible results during testing I had to disable "https-only mode" in Firefox and systematically execute "Forget about this site" in history for cache reset) except for the one in "Reverse Proxy Rules".

In the case of Syncthing, the rules have this configuration:

If I go to https://syncthing.myaccount.synology.me, everything works as it should.

If I go to http://syncthing.myaccount.synology.me, I get the expected result - site is unreachable:

• first redirected to http://syncthing.myaccount.synology.me:5000
• get a response with the code NO_ERROR_CONNECTION_REFUSED:

Well, let's add the rules for http:
Note - "HSTS"-checkbox is disabled when "http" is selected in source protocol

Syncthing is now available over both http and https. But how do I set up automatic redirect from http to https?
In my case, checked "HSTS"-checkbox in the first rules doesn't affect anything (or I just haven't found a correlation).

The weird thing for me is that the "HSTS"-checkbox becomes disabled when "http" is selected in the source protocol.
Why is it available when "https" is selected? https doesn't need to be upgraded to https, it already is.
And why is it disabled with "http"? That's where there is a need to upgrade the protocol from http to https.

I tried adding one rule (instead of the last one):

But it didn't bring the expected result - Syncthing still available over both http and https (because, I guess, when accessed over http there is an internal redirect to external https-address, not an external redirect).

Am I missing something again?

 

[Rusty]

If so, why? DSM on these ports is only available on the internal network. Or am I missing something?

In case you have plans opening those to the web is what I mean. If that is not the case, ignore it.

But how do I set up automatic redirect from http to https?

I would recommend to use a custom reverse proxy, and not the built in one, but if you want to continue to use it, then maybe this process will help you to get redirect working as intended.

HTTP to HTTPS redirect

http to https redirect nas dsm synology revers proxy docker virtual host web

www.blackvoid.club

WebStation will be needed to get this working, so again, if this is not something that you want, I would again suggest to just use a dedicated/separate nginx reverse proxy that has this built in, like NPM for one.

NGINX proxy manager

Run your own NGINX reverse proxy manager in Docker on your Synology NAS and open up to a lot more features then what the built-in version offers

www.blackvoid.club

 

[kartashov.al.and]

NGINX proxy manager

Thank you for sharing!

 

[Gerard]

I would again suggest to just use a dedicated/separate nginx reverse proxy that has this built in, like NPM for one.

NGINX proxy manager

Run your own NGINX reverse proxy manager in Docker on your Synology NAS and open up to a lot more features then what the built-in version offers

www.blackvoid.club

Is there a way to configure this to run in one container, instead of having an app container and DB container?

 

[dimfil]

Is there a way to configure this to run in one container, instead of having an app container and DB container?

The setup instructions have a compose file for this.

 

[Rusty]

Is there a way to configure this to run in one container, instead of having an app container and DB container?

Ofc you can make a single compose for this no problem. Personally I like to separate front end apps from back end (but that is just me), so that is the reason why the guide is presented that way.