FOOD FOR THOUGHT Secure UCP/Admin while still allowing LetsEncrypt

[kameleon]

I am using IPBX 2027-U and am running into issues with the letsencrypt auto renewal. By default port 80 is being blocked with iptables so in order to renew the cert I have to manually allow 80, renew the cert, and disable 80. Is there any way to move the ucp and admin off of 80, ideally only be available over my zerotier network, and still allow letsencrypt to do its thing?

 

[chris_c_]

Yes, set UCP to listen only on the zerotier hostname or IP, on port 80 and 443.

To achieve this, we need to tell the Apache web server to bind specifically to your ZeroTier IP address rather than "listening" on every available interface.

Here is how to configure your system to listen only on your ZeroTier IP for ports 80 and 443.

---

1. Identify your ZeroTier IP​

Before making changes, you need the exact IP address assigned to your ZeroTier interface (usually zt0 or similar).

Run this command in your CLI:

ip addr show

Look for the entry associated with your ZeroTier network and note the IP address (e.g., 10.147.17.2).

2. Configure Apache Listen Directives​

1. nano /etc/apache2/ports.conf
2. Locate the Listen directives. You want to change them from generic ports to IP-specific ports:

Change this:

Listen 80

Listen 443

To this (using your ZT IP):

Listen 10.147.17.2:80

Listen 10.147.17.2:443

3. Adjust the Virtual Hosts​

If you want to ensure the UCP specifically responds only to the ZeroTier hostname, you may need to edit the VirtualHost file for the UCP.

In /etc/apache2/hosts-enabled/<YourIPBXhost>.conf ensure the VirtualHost tag has the IP:

Apache
<VirtualHost 10.147.17.2:80>
# Configuration here
<VirtualHost>

4. Restart Apache​

For the changes to take effect, restart the web server:

sudo systemctl restart apache2

---

Important Considerations​

• Admin Access: If you bind ports 80 and 443 to the ZeroTier IP, you will not be able to access the login page via your local LAN IP or Public IP anymore. Ensure your ZeroTier connection is stable before applying.
• Port Conflicts: If you have the FreePBX Admin Panel and UCP sharing ports, this binding applies to both. If you want them separate, you must assign them different ports, or different subdomain names.

 

[kameleon]

Thank you for that. A few issues though.

When I get to #3 The only UCP stuff I have in Settings Advanced is the UCP NodeJS Server which was set to port 8001 and 8003 by default but I am not sure that is what I think it is because I get to the UCP and admin from port 80, not 8001/8003. Also there is no Firewall under Connectivity, or anywhere else I can find so not sure what to do there.

When I got to looking at making the changes on #4 I saw all my ucp and admin stuff is in the /var/www/html and there is no hosts-enabled but rather sites-enabled which is just distro specific differences if I remember correctly so basically the same thing.

All this and won't I still need to leave port 80 open to apache so that letsencrypt can read whatever file they need for certificate renewal?

 

[kenn10]

Never trust crap from an AI's output. Also, if someone is posting AI output, they should specify that in their post so that readers are forewarned. The above "instructions" are directly from a Google search and obviously not tested by the poster. The information above is not accurate for IncrediblePBX. The various "connectivity" menu items are for licensed FreePBX distro on FreePBX-17.

 

[chris_c_]

Thank you for that. A few issues though.

Post updated.