Is the Admin Panel in the browser actually safe from local spoofers and is AdGuard encryption possible?

Technical Support for Routers
1

Greetings!

I was wondering that how safe the web access panel is really from local spoofers.
By default the router uses HTTP, so traffic is not encrypted.
This means that a malicious actor could in theory analyze network traffic when using the same wireless network.

I make sure to either connect to the router directly via cable when managing it, or use the onboard VPN server option when connecting wirelessly.

I have the following questions:

  • Using the before mentioned: is it safe to assume that no actor could spoof the credentials when using the unencrypted (HTTP) interface? (So, I only access it directly via cable, or via VPN when connecting via a wireless network.
  • Why is it so that by default the web interface is unencrypted? Is there a rational design choice from the developers for this?
  • Of course I could do for instance 192.168.8.1:443 to use an encrypted connection, but in that case the AdGuard Home web interface is not accessible, encryption is impossible for it when using the onboard solution(, or I am just not aware how to do it). This makes it rather inconvenient. Is it possible to set up the onboard solution to use encryption?

Thanks for your answers!

2

For Router Admin Panel:
You can access it using https in 4.x firmware.

  • Just enter the address starting with https into the address bar of your browser, e.g. https://192.168.8.1
  • Our App use the https API by default.
  • The router has a self-signed certificate built in. If you need to replace it, please replace /etc/nginx/nginx.cer and /etc/nginx/nginx.key

For ADGuard Home Web:
The ADGuard Home web is independent, it is not maintained by us.
You need enable https access: AdGuard Home: Encryption Settings

2 Likes
3

Hi!

Thank you for the answer.

As you and I have mentioned, I can specify the protocol in the browser window.

However as you can see, when trying to enable encryption, it is not possible to do so.

image
image1558Ă—871 96.2 KB

Thank you for the tip regarding the cert!

1 Like
4

The prompt shows that port 443 is already occupied. Router Admin Panel already uses 443 as the port for https access. So, you need to change to a different port, for example 3001.

2 Likes
5

Is it possible to do so from the GUI? The problem is that the field is only editable if the field is checked in, but when checking it in and updating the port number, it can not be saved due the error I have sent you screenshot above.

6

The settings are not applied when Enable Encryption is checked. You can change the port number once it has been checked.
At the bottom of the page there is a “Save configuration” button that you need to click on to apply it. It is disabled by default. You will need to enter the certificate file before you can click on it.

image
image1256Ă—954 37.9 KB

7

I think, it is important to highlight the differences between these two paths. I overlooked the difference:

image
image1096Ă—177 3.09 KB

/etc/nginx/nginx.cer

image
image1145Ă—151 1.75 KB

/etc/nginx/nginx.key

8

Does anyone know, how to configure AdGuardHome, so I can see the IP addresses in this overview, and not just these two?
image

9

There are some discussion

10

The 4.2 snapshot firmware has options to configure this.
image

2 Likes
11

I updated to the latest firmware snapshot:

image
image1198Ă—636 12 KB

As you can see, only the requests from the DHCP router, which is also the cable modem, are listed. Anything else I have to configure/change?

12

Did you turn on the switch in my screenshot?

13

Yes, I did:
image

14

Your client is not connected directly to the GL router? If there is a NAT between the two, the router cannot know which device initiated the request.

15

The GL router is via the WAN interface connected to the DHCP router. I use just one specific GL router as AdguardHome router.

16

Maybe Drop-in Gateway can solve this problem If you must use another router to provide DHCP.

If you can change the topology, you can try it.
The LAN port of the your FritzBox connect to the WAN port of the GL.iNet router via an ethernet cable. Log in to the your FritzBox’s admin panel to set the DHCP gateway to GL.iNet router’s IP.

17

Hi, I just saw that all clients are listed on that page in the AdGuardHome page

image
image1194Ă—1423 19.6 KB

If it is possible to display the clients here, it shouldn’t be a big problem on the front page, or?

18

What does front page mean? AdGuard Home’s Home Page or AdGuard Home page in GL UI?

19

I meant in the AdGuardHome client. I believe, here lays the error. But this has nothing to do with Gli-Net, but rather AdGuardHome.

20

Are you referring to the “Persistent Clients” above? This list needs to be added manually by the user via IP or MAC.