Is the Admin Panel in the browser actually safe from local spoofers and is AdGuard encryption possible?

iplayzed · 2022-12-27T17:01:26.390Z

Greetings!

I was wondering that how safe the web access panel is really from local spoofers.
By default the router uses HTTP, so traffic is not encrypted.
This means that a malicious actor could in theory analyze network traffic when using the same wireless network.

I make sure to either connect to the router directly via cable when managing it, or use the onboard VPN server option when connecting wirelessly.

I have the following questions:

Using the before mentioned: is it safe to assume that no actor could spoof the credentials when using the unencrypted (HTTP) interface? (So, I only access it directly via cable, or via VPN when connecting via a wireless network.
Why is it so that by default the web interface is unencrypted? Is there a rational design choice from the developers for this?
Of course I could do for instance 192.168.8.1:443 to use an encrypted connection, but in that case the AdGuard Home web interface is not accessible, encryption is impossible for it when using the onboard solution(, or I am just not aware how to do it). This makes it rather inconvenient. Is it possible to set up the onboard solution to use encryption?

Thanks for your answers!

yuxin.zou · 2022-12-28T01:57:53.749Z

For Router Admin Panel:
You can access it using https in 4.x firmware.

Just enter the address starting with https into the address bar of your browser, e.g. https://192.168.8.1
Our App use the https API by default.
The router has a self-signed certificate built in. If you need to replace it, please replace /etc/nginx/nginx.cer and /etc/nginx/nginx.key

For ADGuard Home Web:
The ADGuard Home web is independent, it is not maintained by us.
You need enable https access: AdGuard Home: Encryption Settings

iplayzed · 2022-12-28T10:45:15.588Z

Hi!

Thank you for the answer.

As you and I have mentioned, I can specify the protocol in the browser window.

However as you can see, when trying to enable encryption, it is not possible to do so.

image1558×871 96.2 KB

Thank you for the tip regarding the cert!

yuxin.zou · 2022-12-28T11:09:07.378Z

The prompt shows that port 443 is already occupied. Router Admin Panel already uses 443 as the port for https access. So, you need to change to a different port, for example 3001.

iplayzed · 2022-12-28T11:19:54.209Z

Is it possible to do so from the GUI? The problem is that the field is only editable if the field is checked in, but when checking it in and updating the port number, it can not be saved due the error I have sent you screenshot above.

yuxin.zou · 2022-12-29T01:21:12.086Z

The settings are not applied when Enable Encryption is checked. You can change the port number once it has been checked.
At the bottom of the page there is a “Save configuration” button that you need to click on to apply it. It is disabled by default. You will need to enter the certificate file before you can click on it.

image1256×954 37.9 KB

mainufer · 2023-02-10T07:30:24.491Z

I think, it is important to highlight the differences between these two paths. I overlooked the difference:

image1096×177 3.09 KB

/etc/nginx/nginx.cer

image1145×151 1.75 KB

/etc/nginx/nginx.key

mainufer · 2023-02-10T07:32:14.250Z

Does anyone know, how to configure AdGuardHome, so I can see the IP addresses in this overview, and not just these two?

alzhao · 2023-02-10T09:23:32.202Z

There are some discussion

GL-MV1000 with AdGuard all clients show as localhost Technical Support for Routers

I just got a GL-MV1000 and setup AdGuard, and its working amazingly. The only issue I’m having is that all my clients in the logs show as localhost. I can’t figure out what setting I change to make it so it shows all the clients IP’s instead of localhost. Thanks!

yuxin.zou · 2023-02-10T09:24:17.594Z

The 4.2 snapshot firmware has options to configure this.

mainufer · 2023-02-11T07:43:23.392Z

I updated to the latest firmware snapshot:

image1198×636 12 KB

As you can see, only the requests from the DHCP router, which is also the cable modem, are listed. Anything else I have to configure/change?

yuxin.zou · 2023-02-11T08:07:44.263Z

Did you turn on the switch in my screenshot?

mainufer · 2023-02-11T08:09:13.911Z

yuxin.zou:

ou turn on the switch in my screenshot?

Yes, I did:

yuxin.zou · 2023-02-11T08:11:07.997Z

Your client is not connected directly to the GL router? If there is a NAT between the two, the router cannot know which device initiated the request.

mainufer · 2023-02-11T08:22:45.260Z

The GL router is via the WAN interface connected to the DHCP router. I use just one specific GL router as AdguardHome router.

yuxin.zou · 2023-02-11T11:05:07.250Z

Maybe Drop-in Gateway can solve this problem If you must use another router to provide DHCP.

If you can change the topology, you can try it.
The LAN port of the your FritzBox connect to the WAN port of the GL.iNet router via an ethernet cable. Log in to the your FritzBox’s admin panel to set the DHCP gateway to GL.iNet router’s IP.

mainufer · 2023-02-20T14:23:32.097Z

Hi, I just saw that all clients are listed on that page in the AdGuardHome page

image1194×1423 19.6 KB

If it is possible to display the clients here, it shouldn’t be a big problem on the front page, or?

yuxin.zou · 2023-02-21T01:34:54.213Z

What does front page mean? AdGuard Home’s Home Page or AdGuard Home page in GL UI?

mainufer · 2023-02-21T20:52:50.848Z

I meant in the AdGuardHome client. I believe, here lays the error. But this has nothing to do with Gli-Net, but rather AdGuardHome.

yuxin.zou · 2023-02-22T01:20:27.334Z

Are you referring to the “Persistent Clients” above? This list needs to be added manually by the user via IP or MAC.