# Vaultwarden behind Sophos XGS WAF

**URL:** <https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432>\
**Category:** Third Party Help\
**Created:** [March 12, 2024, 9:16am UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432 "2024-03-12T09:16:13Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jaeggrono](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Jaeggrono](https://vaultwarden.discourse.group/u/Jaeggrono)\
**Post date:** [March 12, 2024, 9:16am UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432/1 "2024-03-12T09:16:13Z")

</div>

Hello everyone,  
I’ve been hosting Vaultwarden on a Hetznercloud for a few months. So far I had directed the traffic to the server via Nginx reverse proxy and that worked without any problems. Now for security reasons I have put Vaultwarden behind a Sophos XGS with web filtering turned on. Everything works so far, but you can’t create entries from mobile devices and it only works sometimes from the browser. The message “Socket closed” always appears on mobile devices. How does this work exactly? Which paths, URLs or ports are used for this?  
Currently port 443 is forwarded from external to port 80 internally.  
Thank you in advance!  
If you need more information, screenshots or config files feel free to contact me!

---

<div class="post-metadata">

**Author:** ![leclou69](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/leclou69/32/1285_2.png) [@leclou69](https://vaultwarden.discourse.group/u/leclou69)\
**Post date:** [March 13, 2024, 8:05am UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432/2 "2024-03-13T08:05:30Z")

</div>

Hi there,  
you need to manage the forwarding with “path-specific routing” to enable “Web socket passthrough”

 ![grafik](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/9/90652ce158c769d3cf88c108fa367993300b6b96.png)

 ![grafik](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/5/5f98b159b80d3db2d15d00bc08ee4c16b32f507d.png)

Take a look here on how to test the websocket connection: [Enabling WebSocket notifications · dani-garcia/vaultwarden Wiki · GitHub](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-WebSocket-notifications)  
Sincerely, Markus

---

<div class="post-metadata">

**Author:** ![Jaeggrono](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Jaeggrono](https://vaultwarden.discourse.group/u/Jaeggrono)\
**Post date:** [March 13, 2024, 8:48am UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432/3 "2024-03-13T08:48:38Z")

</div>

Thanks Markus,  
I’ve already tried that, but that doesn’t work for me either.  
How do you configured your rule?

This is the error from my browser:

 ![VW3](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/b/b8d30592a33078aa2639f010bd23de8ceb2452a3.png)

Thanks and best regards!  
Philip

---

<div class="post-metadata">

**Author:** ![Jaeggrono](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Jaeggrono](https://vaultwarden.discourse.group/u/Jaeggrono)\
**Post date:** [March 13, 2024, 8:49am UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432/4 "2024-03-13T08:49:14Z")

</div>

This is my Rule:

 ![vw1](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/5/5f02180cf3032caf31fdcc4933925f2abcb61e63.png)

---

<div class="post-metadata">

**Author:** ![Jaeggrono](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Jaeggrono](https://vaultwarden.discourse.group/u/Jaeggrono)\
**Post date:** [March 13, 2024, 8:50am UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432/5 "2024-03-13T08:50:05Z")

</div>

These are my protection settings:

 ![vw2](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/4/45b555f31200b2809a12199ee5e4f85d4bfafe32.png)

---

<div class="post-metadata">

**Author:** ![leclou69](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/leclou69/32/1285_2.png) [@leclou69](https://vaultwarden.discourse.group/u/leclou69)\
**Post date:** [March 13, 2024, 9:19am UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432/6 "2024-03-13T09:19:17Z")

</div>

Hi there,  
I guess it’s the “Zusätzliche Optionen” in your FW-rule or the protection settings.  
In our case I disabled “HTML umschreiben”. “Cookies umschreiben” is not present, which - I guess - is caused by the very loose protection policy.  
I suppose that you need to play around with these settings.  
Greetings Markus

---

<div class="post-metadata">

**Author:** ![Jaeggrono](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Jaeggrono](https://vaultwarden.discourse.group/u/Jaeggrono)\
**Post date:** [March 13, 2024, 10:46am UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432/7 "2024-03-13T10:46:02Z")

</div>

Thanks Markus,  
now I’ve disabled everything what could inspect or analyze the traffic:

 ![vw5](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/0/07235d72d25e0759eace45931f888de62650cd2e.png)  
It still doesn’t work.

Do you have anything special in your configuration?

My config looks like that:

{  
“domain”: “https://_**.de",  
“sends\_allowed”: true,  
“trash\_auto\_delete\_days”: 30,  
“incomplete\_2fa\_time\_limit”: 3,  
“disable\_icon\_download”: false,  
“signups\_allowed”: false,  
“signups\_verify”: true,  
“signups\_verify\_resend\_time”: 3600,  
“signups\_verify\_resend\_limit”: 6,  
“org\_creation\_users”: "**_”,  
“invitations\_allowed”: true,  
“emergency\_access\_allowed”: true,  
“password\_iterations”: 600000,  
“password\_hints\_allowed”: true,  
“show\_password\_hint”: false,  
“admin\_token”: “_**",  
“invitation\_org\_name”: "**_”,  
“ip\_header”: “X-Real-IP”,  
“icon\_redirect\_code”: 302,  
“icon\_cache\_ttl”: 2592000,  
“icon\_cache\_negttl”: 259200,  
“icon\_download\_timeout”: 10,  
“icon\_blacklist\_non\_global\_ips”: true,  
“disable\_2fa\_remember”: false,  
“authenticator\_disable\_time\_drift”: false,  
“require\_device\_email”: false,  
“reload\_templates”: false,  
“log\_timestamp\_format”: “%Y-%m-%d %H:%M:%S.%3f”,  
“admin\_session\_lifetime”: 20,  
“\_enable\_yubico”: true,  
“\_enable\_duo”: true,  
“\_enable\_smtp”: true,  
“use\_sendmail”: false,  
“smtp\_host”: “_**“,  
“smtp\_security”: “force\_tls”,  
“smtp\_port”: ,  
“smtp\_from”: "”,  
“smtp\_from\_name”: “Vaultwarden”,  
“smtp\_username”: "**_”,  
“smtp\_password”: “\*\*\*\*\*\*\*”,  
“smtp\_auth\_mechanism”: “Login”,  
“smtp\_timeout”: 15,  
“smtp\_embed\_images”: true,  
“smtp\_accept\_invalid\_certs”: false,  
“smtp\_accept\_invalid\_hostnames”: false,  
“\_enable\_email\_2fa”: true,  
“email\_token\_size”: 6,  
“email\_expiration\_time”: 600,  
“email\_attempts\_limit”: 3  
}

---

<div class="post-metadata">

**Author:** ![leclou69](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/leclou69/32/1285_2.png) [@leclou69](https://vaultwarden.discourse.group/u/leclou69)\
**Post date:** [March 13, 2024, 2:00pm UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432/8 "2024-03-13T14:00:49Z")

</div>

Hello Philip,  
nope, don’t guess so

```auto
### Your environment (Generated via diagnostics page)
* Vaultwarden version: v1.30.5
* Web-vault version: v2024.1.2b
* OS/Arch: linux/x86_64
* Running within a container: true (Base: Debian)
* Environment settings overridden: true
* Uses a reverse proxy: true
* IP Header check: false (X-Forwarded-For)
* Internet access: true
* Internet access via a proxy: false
* DNS Check: true
* Browser/Server Time Check: true
* Server/NTP Time Check: true
* Domain Configuration Check: true
* HTTPS Check: true
* Database type: MySQL
* Database version: 10.11.7-MariaDB-1:10.11.7+maria~ubu2204
* Clients used: 
* Reverse proxy and version: 
* Other relevant information: 

### Config (Generated via diagnostics page)
<details><summary>Show Running Config</summary>

**Environment settings which are overridden:** DOMAIN, SENDS_ALLOWED, SIGNUPS_ALLOWED, SIGNUPS_VERIFY, SIGNUPS_VERIFY_RESEND_TIME, SIGNUPS_VERIFY_RESEND_LIMIT, SIGNUPS_DOMAINS_WHITELIST, EMERGENCY_ACCESS_ALLOWED, ADMIN_TOKEN

json
{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": false,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_smtp_img_src": "cid:",
  "admin_ratelimit_max_burst": 10,
  "admin_ratelimit_seconds": 60,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": " *****://***********************************************************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": " *****://********************",
  "domain_origin": " *****://********************",
  "domain_path": "",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": 14,
  "experimental_client_feature_flags": "fido2-vault-credentials",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "invitation_expiration_hours": 120,
  "invitation_org_name": " ****************************",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": "/data/vaultwarden.log",
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": " ****************************,***************************",
  "org_events_enabled": true,
  "org_groups_enabled": true,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": " ***************,****************** , **************,*********",
  "signups_verify": true,
  "signups_verify_resend_limit": 5,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": "Login",
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": " ********************",
  "smtp_from_name": " ****************************",
  "smtp_host": " ********************",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": " ************",
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": false,
  "websocket_port": 3012,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

</details>

```

But concerning your screenshot of the FW rule:  
We got no sticky sessions in the pathspecific routing

 ![grafik](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/1/1effbc0e25838f3462233471dc543f0e7c503b59.png)

but we got “Pass host header” activated  
 ![vw_fw2](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/4/438dc10272723d1621f11ebcc4febfb7a730439f.png)

Greetings, Markus

---

<div class="post-metadata">

**Author:** ![Jaeggrono](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Jaeggrono](https://vaultwarden.discourse.group/u/Jaeggrono)\
**Post date:** [March 15, 2024, 10:43am UTC](https://vaultwarden.discourse.group/t/vaultwarden-behind-sophos-xgs-waf/3432/9 "2024-03-15T10:43:38Z")

</div>

Hi Markus,

thanks for your help!  
Now Vaultwarden is working behind the Sophos with a lot of securityfeatures enabled.  
It was a problem with routing. It seems like Sophos has problems if the Webserver is in a different subnet.

Thanks and best regards!