VPN Server plugin for OMV6

Is the OpenVPN plugin still on hold/cancelled for OMV6?

I think its a core application. How else would one be able to access the NAS / (Open)Mediavault from the outside world?

wireguard is 100x more complext to setup than open vpn and offers marginal additional benefit.

Is there a reason why openvpn has been abandoned?

Quote from MarcS

How else would one be able to access the NAS / (Open)Mediavault from the outside world?

If you already have a SWAG container running, then you don't need openVPN.

Quote from chente

swag with fail2ban

Swag container already has fail2ban activated, 😉

Quote from Soma

Swag container already has fail2ban activated, 😉

But out of the box only http auth is protected, isn't it? So any resources like OMV, Nextcloud, etc. would need to be configured separately. Or do I get sth wrong?

Quote from HannesJo

So any resources like OMV, Nextcloud, etc. would need to be configured separately.

As I see it (not sure 100%) as long as swag is secured by fail2ban, all proxied services under it are also secured.

Of course, as chente mentioned, it comes with some default jails that can be improved once you get more knowledge about it.

FWIW, I only have it on defaults and have WAN access to ALL services I run on LAN.

Up to now, zero hits on them.

But the major access to the servers(SSH, NFS shared drive to Windows and other sensible services) are ALL only via wireguard on host.

Quote from chente

It comes with 5 jails by default

I could have sworn it is 3 only. 2 bot searches plus http auth. So I checked and noticed that my config is simply outdated. They introduced nginx-deny and nginx-unauthorized in the mean time but I was simply not aware of it.

Might be a pretty good example of why it is not a good idea to just think everything is gonna be ok and safe out of the box.

Quote from Soma

As I see it (not sure 100%) as long as swag is secured by fail2ban, all proxied services under it are also secured.

Ok. Just did a check-up.

Yes but no. They are protected as long as they produce proper log messages out of the box that can be matched by the default jails. That is eg when you activate basic HTTP auth in a proxy conf.

Jail nginx-http-auth only looks for HTTP requests with a string like password mismatch or user not found. The jail nginx-deny only checks for HTTP requests with sth like (access forbidden by rule). That happens eg when a resource is by proxy conf only allowed to certain IPs and another IP is trying to access. The 3rd jail, nginx-unauthorized checks the unauthorized.log only and the regex has sth with plex in it. Not certain if it is optional or so. However, as you can see below, eg. Nextcloud triggers none of them.

When I setup swag the only active default jails were nginx-botsearch, nginx-badbots and nginx-http-auth and back then I tested if nextcloud is being protected. It was not. So I had to setup a custom rule that uses nextclouds own log file.

I just checked what happens on a failed login attempt at nextcloud. In the nextcloud log I can find the line

{"reqId":"xxx","level":2,"time":"2022-08-10T12:01:50+02:00","remoteAddr":"xxx","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: test (Remote IP: xxx)","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0","version":"24.0.3.2","data":[]}

But on swag logs I can only find in access.log:

xxx - - [10/Aug/2022:12:01:50 +0200] "POST /login HTTP/2.0" 303 0 "https://cloud.xxx/login?noredir=1&direct=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0"
xxx - - [10/Aug/2022:12:01:51 +0200] "GET /login?user=test&direct=1 HTTP/2.0" 200 5340 "https://cloud.xxx/login?noredir=1&direct=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0"

In the error.log and unauthorized.log there is nothing regarding the failed login. So there is simply nothing being matched by any of the default jails.

Nextcloud is in fact only protected when a custom jail is being setup.

Thus, I added to my jail.local:

[nextcloud]

enabled = true
port    = 443,80
filter  = nextcloud
logpath = /nextcloudLog/nextcloud.log

(As you correctly assumed, /nextcloudLog is a bind mount to the log folder in the nextcloud container)

And the filter nextcloud.conf:

  GNU nano 5.4                                        nextcloud.conf                                                 
# http://www.rojtberg.net/711/secure-owncloud-server/
[Definition]
failregex = ^{.*Login failed: '.*' \(Remote IP: '<HOST>'.*}$
            ^{.*Login failed: .* \(Remote IP: <HOST>.*}$
ignoreregex =

Quote from chente

I wouldn't worry too much about Nextcloud. It has its own fail2ban inside the container. If you also configure access with double authentication, I think it is more than protected.

Although your explanation would say that it is valid for other more unprotected services, jellyfin, etc.

I dont know if they have added a working protection to the nextcloud container in the mean time, but as I said when I did the setup - it was definitely not protected. I simply tried to login sth like 20 times from another ip (just used mobile data on the phone) and got never banned.

Edit: Cannot find any fail2ban stuff in the linuxserver/nextcloud repo. But I think you are right that the app itself is already protected quite well. It has stuff like bruteforce protection already built in.