I need a little help for Authelia, how to use 2FA only for connections arriving from internet, to bypass authentication if connecting from internal network.
I am using official container image authelia/authelia and letsencrypt/nginx from LSIO.
- domain: secure.example.com
policy: one_factor
# Network based rule, if not provided any network matches.
networks:
- 192.168.1.0/24
What i want to do is opposite, allow access to web site without authentication, go directly to web site if accessing it from internal network, and use 2FA if accessing same web site from internet.
For now configuration I have is working from internal network as well as from internet, authenticating using 2FA all web sites without any problem. I just want to bypass 2FA from internal network. This is what I tried but it’s not working:
Thanks for your reply. I didn’t had time to try anything until today.
I “solved” my problem. The source of the problem was not reading Authelia documentation properly. This how I solved this:
The problem was that I needed to add “bypass” for same domain in rule.
Now, when accessing web sites from LAN there is no authentication with Authelia, accessing web sites from Internet is done by Authelia using 2FA.
I’ve exactly the same need: bypass authelia authentiaction when accessing my unraid docker containers from my local network.
I access my services using plain subdomain addresses (for example: lidarr.mydomain.ovh) from both external or from internal networks.
But authelia authentication is needed even in local network.
note: I do not have any custom DNS server, or /etc/host configuration… so I wonder how authelia can know on which network I’m trying to access services
If you need 2FA from internal and external networks you need only this:
access_control:
default_policy: deny
rules:
- domain: “*.example.com”
policy: two_factor
When you access your services, your device has some IP address which can be seen in the request sent to Authelia.
In my example above, I have second rule for same domain, to bypass 2FA if clients are on network 192.168.1.0/24. Without this rule 2FA is never bypassed.
Your first rule’s policy is one_factor, as far as I know this is just for using username and password, no 2FA at all. So, the second rule for bypass, I don’t know what it will actually do, but I guess it should just let you go directly to your service without asking for username and password.
And maybe stupid question, is your local network 192.168.1.0/24? The clients are getting IPs from DHCP server (from router maybe) that starts with 192.168.1?
Looks like it should work properly, my config is almost same, except I am using two_factor policy, not one_factor, and I am not asked for any kind of authentication while on local LAN. Works as expected.
Sorry I couldn’t provide more help, maybe some one will have something smarter to say. If anything else comes to mind, I will let you know.
Yes, the rules are like firewall rules. The system starts at the top or first entry – as soon as it meets a condition – it executes the policy and stops.
You have two rules. When you had the original order there wasn’t a network switch, so by default it just considered “all networks” and executed the rule. I’m not sure if authelia has a not or ! switch whereby you could say all networks except the selected something like: