{"id":9318,"date":"2019-12-03T09:53:13","date_gmt":"2019-12-03T08:53:13","guid":{"rendered":"https:\/\/www.boc.de\/watchguard-info-portal\/?p=9318"},"modified":"2024-07-23T15:17:35","modified_gmt":"2024-07-23T13:17:35","slug":"zugriff-auf-watchguard-access-portal-rdp-sitzung-via-nginx","status":"publish","type":"post","link":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/2019\/12\/zugriff-auf-watchguard-access-portal-rdp-sitzung-via-nginx\/","title":{"rendered":"Zugriff auf WatchGuard Access Portal (RDP Sitzung) via NGINX"},"content":{"rendered":"<p>K\u00fcrzlich erreichte uns eine Erfolgsmeldung: ein Administrator hat erfolgreich _VOR_ dem Access Portal einen NGINX-Reverse-Proxy in Betrieb genommen.<\/p>\n<p><!--more--><\/p>\n<p>Setup:<\/p>\n<ul>\n<li>Internet Anbindung, eine Statische IP<\/li>\n<li>Transfer-Netz zur WatchGuard Firewall<\/li>\n<li>Portforward der Externen IP, Port 443 =&gt; auf einen NGINX-Server im Transfer-Netz (VOR der Firewall)<\/li>\n<li>Aufsplitten der DNS-NAMEN im NGINX\n<ul>\n<li>ein Teil geht auf das WatchGuard Access Portal,<\/li>\n<li>andere DNS-Namen werden auf andere Systeme\/IPs\/Ports umgeleitet<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>F\u00fcr den NGINX wird das Modul &#8220;ngingx-extras&#8221; ben\u00f6tigt.<\/p>\n<p>Anbei noch der Config-Ausschnitt aus dem NGINX:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">server {\r\n        listen       *:80;\r\n        server_name servername.firma.de;\r\n        if ($host = servername.firma.de) {\r\n                return 301 https:\/\/$host$request_uri\/;\r\n        }\r\n        return 404; # managed by Certbot\r\n}\r\n \r\nserver {\r\n        server_name servername.firma.de;\r\n        error_log  \/var\/log\/nginx\/servername-error.log;\r\n        access_log \/var\/log\/nginx\/servername-access.log;\r\n \r\n        listen 443 ssl; # managed by Certbot\r\n        ssl_certificate \/etc\/letsencrypt\/live\/firma.de\/fullchain.pem; # managed by Certbot\r\n        ssl_certificate_key \/etc\/letsencrypt\/live\/firma.de\/privkey.pem; # managed by Certbot\r\n        include \/etc\/letsencrypt\/options-ssl-nginx.conf; # managed by Certbot\r\n        ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem; # managed by Certbot\r\n        ssl_verify_client off;\r\n \r\n        # Set global proxy settings\r\n        proxy_read_timeout      360;\r\n \r\n        proxy_http_version 1.1;\r\n        proxy_pass_request_headers on;\r\n \r\n        proxy_pass_header       Date;\r\n        proxy_pass_header       Server;\r\n \r\n        proxy_set_header        Host $host;\r\n        proxy_set_header        X-Real-IP $remote_addr;\r\n        proxy_set_header        Accept-Encoding \"\";\r\n \r\n        proxy_set_header Accept-Encoding \"\";\r\n        more_set_headers -s 401 'WWW-Authenticate: Basic realm=\"192.168.1.89\"';\r\n \r\n        location \/ {\r\n        proxy_set_header Host $http_host;\r\n        proxy_set_header X_FORWARDED_PROTO https;\r\n        proxy_ssl_verify              off;\r\n        proxy_pass https:\/\/192.168.1.89:4443\/;\r\n    }\r\n        location \/websocket-tunnel {\r\n        proxy_read_timeout 86400;\r\n        proxy_pass https:\/\/192.168.1.89:4443;\r\n        proxy_http_version 1.1;\r\n        proxy_set_header Upgrade $http_upgrade;\r\n        proxy_set_header Connection \"Upgrade\";\r\n    }\r\n}\r\n<\/pre>\n<p>Herzlichen Dank an Hr. Hildebrand f\u00fcr die Informationen zu diesem Artikel.<\/p>\n<p>R\u00fcckfragen bitte direkt an <a href=\"mailto:d.hildebrand@vogelsbergklinik.de\">d.hildebrand@vogelsbergklinik.de<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>K\u00fcrzlich erreichte uns eine Erfolgsmeldung: ein Administrator hat erfolgreich _VOR_ dem Access Portal einen NGINX-Reverse-Proxy in Betrieb genommen.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[430,620,525,563],"class_list":["post-9318","post","type-post","status-publish","format-standard","hentry","category-watchguard-technischer-blog","tag-access-portal","tag-nginx","tag-rdp","tag-reverse-proxy"],"_links":{"self":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts\/9318"}],"collection":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/comments?post=9318"}],"version-history":[{"count":8,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts\/9318\/revisions"}],"predecessor-version":[{"id":21196,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/posts\/9318\/revisions\/21196"}],"wp:attachment":[{"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/media?parent=9318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/categories?post=9318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.boc.de\/watchguard-info-portal\/wp-json\/wp\/v2\/tags?post=9318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}