2.2.9 Security Enhancements?

🛎️ Get Help
23

It would be part of the URL you would use.

But, you shouldn’t have to use this setting for that, by default all private IPs are allowed. I also have a number of VLANs and I’m still able to access without issue.

1 Like
24

2.2.9.129 allows CIDR subnet notations, e.g. 1.2.3.4/24. It does not allow subnets broader than /24, though.

25

Once you bring up hub's UI, e.g. http://192.168.1.5/, add the endpoint to that URL, e.g. http://192.168.1.5/hub/allowSubnets?123.123.123.0,124.124.124.0

2 Likes
26

I would make the suggestion that this is something that should be under the advanced networking section in the UI.

The ability to do this shouldn't exactly require soneobe finding these threads down the road.

6 Likes
27

…but then they’d miss out on the joy of searching the forum for these precious nuggets…:rofl:

Actually not a bad idea.

7 Likes
28

I think the devs at Hubitat would sooner commit Sepaku than go the way of Wink in any way, shape, or form...

1 Like
29

That is going to happen. Can't promise the timeline, but sooner rather than later.

5 Likes
30

So, closer to 2.2.9.130 than 3.0.0.1.

1 Like
31

Thank you. That worked perfectly.

2 Likes
32

Whatever proxy you use, can you try commenting out X-Forwarded-For header? As in do not have proxy create one. That made a difference between receiving real IP vs. proxy's IP on my (admittedly very basic) nginx setup.

Yes, I said it's not looking at the headers just a few posts above... obviously, something implicitly does.

1 Like
33

So I just upgraded to .129 and found that my WebVPN Portal no longer works - I cant say I'm very impressed by this! :weary:

Now All I get is this when I try to connect:
Screen Shot 2021-10-10 at 1.45.54 pm

It's my own fault I guess for assuming the solution I use would be unaffected:

But if you guys could please add an option to allow competent IT folk to manage their own security, that'd be great, m'kay.

PS, adding my public IP doesnt solve the issue for me, however using a standard VPN tunnel into my network does still work.

1 Like
35

Figured where Jetty was processing the header (sneaky) and how to disable that processing. Next update will have the fix.

5 Likes
36

Fix is out in 2.2.9.130, please let me know if it solves the issue.

6 Likes
37

Cheers, I’ll try it today.

38

Yep, my VPN Web portal is back online, lovely work sir! :heart_eyes:

1 Like