Wings behind Cloudflare

[MAXOUXAX]

Hey there!
I'm trying to connect a node behind Cloudflare to my panel (which is not).

I enabled the "behind proxy" option, and also tried as a troubleshooting step to add the TRUSTED_PROXIES option in the .env file (as seen in the old 0.7 Panel documentation here) but ended up with this error in my panel logs:

[2020-12-17 00:15:04] production.WARNING: GuzzleHttp\Exception\ConnectException: cURL error 35: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) in /var/www/pterodactyl/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.php:200
Stack trace:
#0 /var/www/pterodactyl/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.php(155): GuzzleHttp\Handler\CurlFactory::createRejection(Object(GuzzleHttp\Handler\EasyHandle), Array)
#1 /var/www/pterodactyl/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.php(105): GuzzleHttp\Handler\CurlFactory::finishError(Object(GuzzleHttp\Handler\CurlHandler), Object(GuzzleHttp\Handler\EasyHandle), Object(GuzzleHttp\Handler\CurlFactory))

(full logs)

Is it possible to run the daemon behind Cloudflare at all?
If so, what did I do wrong?

Thanks! :)

[trenutoo]

The wings port should be 8443 with Cloudflare proxy, quite interesting that you are proxying wings but not the panel. You definitely can run Wings/daemon behind the Cloudflare, but it can cause headaches such as this and SFTP won't work off without exposing it through a different IP/domain.

Can you provide your web server conf file?

[MAXOUXAX]

quite interesting that you are proxying wings but not the panel.

The reasoning behind this is that my panel and my first node is hosted on an OVH server which is DDoS protected, but the second node I just added is hosted on an homeserver which is obviously not.

So I'm trying to protect the homeserver's IP with Cloudflare and TCPShield (which is a fantastic and free way to protect game servers that I'm sure you already heard of)

and SFTP won't work off without exposing it through a different IP/domain.

Can you develop that sentence?
If you're just talking about the SFTP credentials that the panel offers for each server, it's not a big deal as my team is mostly using the server SFTP with their credentials or the built-in File Manager ^^

Can you provide your web server conf file?

How would that help?

EDIT

I changed the Daemon Port to be 8443 and enabled the "behind proxy" option, opened the port on the homeserver and enabled Cloudflare on the node FQDN, then restarted Wings but it's still not working

[2020-12-18 12:04:20] production.ERROR: GuzzleHttp\Exception\ServerException: Server error: `GET https://wings adress:8443/api/system` resulted in a `503 Service Temporarily Unavailable`

(full logs)

[lstefan1520]

quite interesting that you are proxying wings but not the panel.

The reasoning behind this is that my panel and my first node is hosted on an OVH server which is DDoS protected, but the second node I just added is hosted on an homeserver which is obviously not.

So I'm trying to protect the homeserver's IP with Cloudflare and TCPShield (which is a fantastic and free way to protect game servers that I'm sure you already heard of)

and SFTP won't work off without exposing it through a different IP/domain.

Can you develop that sentence?
If you're just talking about the SFTP credentials that the panel offers for each server, it's not a big deal as my team is mostly using the server SFTP with their credentials or the built-in File Manager ^^

Can you provide your web server conf file?

How would that help?

EDIT

I changed the Daemon Port to be 8443 and enabled the "behind proxy" option, opened the port on the homeserver and enabled Cloudflare on the node FQDN, then restarted Wings but it's still not working

[2020-12-18 12:04:20] production.ERROR: GuzzleHttp\Exception\ServerException: Server error: `GET https://nodevps2-fr.maxouxax.me:8443/api/system` resulted in a `503 Service Temporarily Unavailable`

(full logs)

Hey, you don't need to enable "behind proxy". I've always kept it disabled and used cloudflare's origin certificates on the node and never had an issue before.

[MAXOUXAX]

I'm not using Cloudflare's origin certificates so I might leave it enabled ^^

[TekExplorer]

Hello @MAXOUXAX!

That appears to be an SSL related error. Ensure the following for running nodes behind Cloudflare:

1. The node needs to use port 8443 or another supported SSL port for Cloudflare
2. That you have Cloudflare configured properly, I recommend the following:
   • Set up your node with behind proxy disabled
   • CF should be set to FULL SSL
   • Your node should be configured with CF Origin or LE certs
   • Ensure your daemon is actually running; This command should tell you: systemctl status wings

I realize you are not using certs on the system currently, but it saves quite a few headaches to just use one.

Edit: note that your panel may struggle to save any port changes for the node because of Cloudflare. if this happens, disable Cloudflare Proxy and set up normally with regular certs, then re-enable Cloudflare once you ensure it works

[MAXOUXAX]

Hello @MAXOUXAX!

That appears to be an SSL related error. Ensure the following for running nodes behind Cloudflare:

1. The node needs to use port 8443 or another supported SSL port for Cloudflare

2. That you have Cloudflare configured properly, I recommend the following:

   • Set up your node with behind proxy disabled
   • CF should be set to FULL SSL
   • Your node should be configured with CF Origin or LE certs
   • Ensure your daemon is actually running; This command should tell you: systemctl status wings

I realize you are not using certs on the system currently, but it saves quite a few headaches to just use one.

Edit: note that your panel may struggle to save any port changes for the node because of Cloudflare. if this happens, disable Cloudflare Proxy and set up normally with regular certs, then re-enable Cloudflare once you ensure it works

Well looks like it was either a problem with the behind proxy option, or related to the edit you made to your message.
Anyways, it's working now, thank you all! :D

[MAXOUXAX]

Realised the SFTP accesses were broken, tried to change the SFTP port to a compatible Cloudflare HTTPS port but I'm getting this error: Remote side unexpectedly closed network connection

EDIT: I might be dumb, Cloudflare doesn't support the sftp:// protocol right?

[MAXOUXAX]

Running into a weird problem where every server in the servers tab is not loading but the actual server dashboard is working (server console, resources graphs, etc).
I got some 504 in the browser console saying There was an exception while attempting to communicate with the daemon resulting in a HTTP/503 response code. This exception has been logged.
When I look into the panel logs, I got production.WARNING: GuzzleHttp\Exception\ServerException: Server error: 'GET https://nodeurl:8443/api/servers/555a19ac-66e6-4d5a-bb25-3b10a8d5c192' resulted in a '503 Service Temporarily Unavailable'.

I looked into Wings logs, even ran it with the --debug option, and there is nothing, so the error is coming from Cloudflare. But why?

Also, the File Manager is broken and I'm getting the exact same error from it.

[trenutoo]

Realised the SFTP accesses were broken, tried to change the SFTP port to a compatible Cloudflare HTTPS port but I'm getting this error: Remote side unexpectedly closed network connection

EDIT: I might be dumb, Cloudflare doesn't support the sftp:// protocol right?

You can not proxy the SFTP on Cloudflare without enterprise/spectrum plan. You would have to expose your server sftp using a different domain.

[MAXOUXAX]

Yeah alright that's what I was thinking ^^
Still got issues with the above message though :/