Reverse proxy warning

[PierreScerri]

The problem

I am getting this warning:

Logger: homeassistant.components.http.forwarded
Source: components/http/forwarded.py:90
Integration: HTTP (documentation, issues)
First occurred: 10:13:32 (97 occurrences)
Last logged: 11:44:27

A request from a reverse proxy was received from 172.30.33.2, but your HTTP integration is not set-up for reverse proxies; This request will be blocked in Home Assistant 2021.7 unless you configure your HTTP integration to allow this header.

I don't understand what needs to be done.

What is version of Home Assistant Core has the issue?

core-2021.6.5

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant OS

Integration causing the issue

http

Link to integration documentation on our website

https://www.home-assistant.io/integrations/http/

Example YAML snippet

No response

Anything in the logs that might be useful for us?

Many times:

2021-06-18 11:44:22 WARNING (MainThread) [homeassistant.components.http.forwarded] A request from a reverse proxy was received from 172.30.33.2, but your HTTP integration is not set-up for reverse proxies; This request will be blocked in Home Assistant 2021.7 unless you configure your HTTP integration to allow this header
2021-06-18 11:44:22 WARNING (MainThread) [homeassistant.components.http.forwarded] A request from a reverse proxy was received from 172.30.33.2, but your HTTP integration is not set-up for reverse proxies; This request will be blocked in Home Assistant 2021.7 unless you configure your HTTP integration to allow this header
2021-06-18 11:44:22 WARNING (MainThread) [homeassistant.components.http.forwarded] A request from a reverse proxy was received from 172.30.33.2, but your HTTP integration is not set-up for reverse proxies; This request will be blocked in Home Assistant 2021.7 unless you configure your HTTP integration to allow this header
2021-06-18 11:44:27 WARNING (MainThread) [homeassistant.components.http.forwarded] A request from a reverse proxy was received from 172.30.33.2, but your HTTP integration is not set-up for reverse proxies; This request will be blocked in Home Assistant 2021.7 unless you configure your HTTP integration to allow this header

Additional information

There is no http: section in my configuration.yaml.
NGINX is installed with this config:

domain: xxxxxx.duckdns.org
certfile: fullchain.pem
keyfile: privkey.pem
hsts: max-age=31536000; includeSubDomains
cloudflare: false
customize:
active: false
default: nginx_proxy_default*.conf
servers: nginx_proxy/*.conf

[probot-home-assistant]

http documentation
http source
_{^{(message by IssueLinks)}}

[elupus]

You need to setup trusted_proxies and use_x_forwarded_for in the http integration if you have a proxy in front of home assistant.

[PierreScerri]

Thank you for your reply.

Would this be a good configuration :

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 10.0.0.200
    - 172.30.33.0/24
  ip_ban_enabled: true
  login_attempts_threshold: 5

My home network is on 192.168.x.x
I use http for local access and https/duckdns for external access.

[elupus]

Your trusted proxy should be the exact up address on the internal side of your ngnix computer. Should not be a mask (/24).

If it's a separate computer from home assistant, it should be on the 192.168.x.x range.

If it's a docker instance, you need to figure out what up it uses to talk to home assistant.

[elupus]

Ps. Based on your logs, it would indicate your ngnix uses 172.30.33.2 to speak to your home assistant instance.

[PierreScerri]

Ok
Is this what you mean:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.33.2
  ip_ban_enabled: true
  login_attempts_threshold: 5

[elupus]

Yup

[PierreScerri]

Thank you for your time.

Rebooting HA as we speak.

[cromulus]

The documentation seems to indicate that a subnet mask is an acceptable value for trusted_proxies.

Is that incorrect?

[elupus]

It is, but it should not overlap trusted networks or any other used networks. There are security problems with that.

[WilfridoT]

Hi I got the same issue with 2021.7 and I try
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.30.33.2
ip_ban_enabled: true
login_attempts_threshold: 5

but it didnt work any recomendations? I am using Ngnix proxy manager in HA

[Kisty]

@WilfridoT go to configurations > integrations > configuration.yaml check the logs link > check the reverse proxy ip address (might be different for you)

[cromulus]

Would whitelisting the entirety of docker subnet be safe? Or is there a way to ensure that the Nginx proxy docker instance always gets the same ip? Cheers, Bill - sent on the move.

…

_______________________ (he, his, him)

On Jul 9, 2021, at 2:11 AM, Joakim Plate ***@***.***> wrote:  It is, but it should not overlap trusted networks or any other used networks. There are security problems with that. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or unsubscribe.