Can't create and connect a newt site with Cloudflare Proxied Domain

[kgoode517]

Took me quite some time to figure this out but for my self hosted pangolin server turns out for my cloudflare domain sites only work when I don't have the dns proxied otherwise it can't connect. Any advice on getting around this to keep my orange cloud cloudflare benefits?

[mellow65]

The issues is because Newt uses wireguard and WG ports for it's initial set up when initiated. And the proxy service offered by cloudflare wont pass that port through their proxy service, so this is why you have to deactivate the proxy.

https://developers.cloudflare.com/fundamentals/reference/network-ports/

I ran into this after I originally set my pangolin service up also. I tried a bunch of things like trying to use my public IP in place of my pangolin.mywebsite.com when setting up newt, but I wasn't able to ever get around it.

if you set everything up as they recommend, where you have pangolin.mywebsite.com and the wildcard *.mywebsite.com, you can turn on the proxy service for the wildcard entry, assuming you're not passing anything though it other than basic interfaces.

I do believe if you use a wireguard connection instead of newt you wont run into this, but that comes with it's level of knowing how to set it up.

You could also set up tailscale on your home network and set up advertised routes, then set up tailscale on your VPS (I'm assuming pangolin is on a VPS) then set up a local site with no tunneling, but still aim all your resources at your local IP addresses. As no wireguard requests are being sent to your main domain (or even you public IP, for that matter) i can't see why you shouldn't be able to turn on the proxy service for your main domain. I may play with this idea later.

[oschwartz10612]

Usually you can get around this by using the IP of the pangolin server NOT the domain name as the base_endpoint: in the config.yml file. Restart and newt wont connect through cloudlfare.

[a-hersa]

Thank you so much.

[Schu-]

Just wanted to bump this as I have followed the documentation, but it does not seem to still work. My config is setup with IP but once Newt tries to reach out it gets a 403 error from CF and not able to attach. I created a new instance and still seems to do the same. Also I can confirm Newt and Gerbil are setup and working as if I remove CF it attaches right away.

I was able to confirm that gerbil is reading the config (in some way), but it does not seem to work as is documented. Not only that but when trying to change the gerbil subnet that part of the config also seems to drop off and never even be taken. I have been looking to try and see where things went wrong but no logs or anything so far show what's up.

Any other advice on this would be great. I am at a hard stop since Newt is not working.

[Schu-]

Hello All. I would like to update this post since I finally was able to narrow down the issue and fix it. After much research and looking at multiple logs, I came across a log for Cloudflare that shows what is going on.

TLDR;
CloudFlare has a "Bot Fight" Mode. If this mode is enabled, it will stop Newt from accessing the URI and passing the creds needed. I have also learned that the Free CloudFlare account WILL NOT allow you to create a WAF rule to bypass this URI. Just wanted to pass along the knowledge.

Maybe we could add this into the Pangolin documentation for CloudFlare @oschwartz10612? Thanks again for all the hard work and this awesome tool.

[AstralDestiny]

You can fix that via, (http.request.uri.path wildcard r"/api/v1/auth/*")

You can likely restrict it more though.

[Schu-]

Thanks @AstralDestiny. I did implement this but unfortunately CloudFlare still blocks it. I was only about the find this post and one other (that of course i cant find now) that free still doesnt allow it. =/

https://community.cloudflare.com/t/how-to-skip-bot-checks-with-custom-waf-rules/738558