https for Freetz WebIF

[fraternl]

I'm accessing the Freetz WebIF remotely on several boxes.
It's done with http which is a security-risk if somehow the connection is compromised.

Are there any plans put ssl in front?
I'm talking about a standardized solution selectable with make menuconfig.

Or is no-one interested in it?

[aus-sua]

The "remote problem" is not new, there are several ways to solve it.

One thing first:
Sharing the http-freetz-NG-Web-IF via external port forwarding is
the worst and stupidest "remote solution"!
(RTFM... )

Possible would be e.g.:

• SSH (dropbear+port forwarding) via tunnel port
• stunnel
• openvpn
• WireGuard
• ...

For Windows users you can use ssh + putty with tunnel options and a
browser.

So you don't need a https-Web-If for the freetz-NG-Web-If,
but you are welcome to create one :-)

---

Das "Remote-Problem" ist doch nicht neu, es gibt mehrere Möglichkeiten dieses zu lösen.

Eines vorweg:
Ein Freigabe das http-freetz-NG-Web-IF per externer Portfreigabe ist
sicherheitstechnisch sicherlich die schlechteste und dümmste "Remote"-Lösung!
(RTFM... ).

Möglich wäre z.B.:

• SSH (dropbear+Portfreigabe) per Tunnel-Port
• Stunnel
• openvpn
• WireGuard
• ...

Für Windows-Nutzer bietet sich ssh + putty mit Tunnel-Optionen + Browser an.

Ein https-Web-If für das freetz-Web-If braucht es dafür also nicht unbedingt,
Du kannst aber gerne eines erstellen :-)

[fraternl]

I know how to make one myself.
The short answer is no.

[aus-sua]

I mostly use the easy way via SSH (dropbear already works on the box) and putty/kitty as the gateway.
If you need more information about this, just ask.

[fda77]

I use lighttpd for various local http/-s servers. It can forward with "mod_proxy" depending on http-subdir or http-hostname to a servers in the lan. Also you could use seprarate ssl certs for every host, or letsencrypt or le wildcard. An additional authentification is also possible eg

... { proxy.server = ( "" =>  ( ( "host" => "192.168.178.1", "port" => 80   ) ) ) }
... { proxy.server = ( "" =>  ( ( "host" => "192.168.178.1", "port" => 81   ) ) ) }

This even prevent bruteforce on this server as the host or subdir are not public.
For external lighttpd i additional use selinux on systems supporting it