<div dir="ltr"><div>Thanks for all the info. I think I sorted out the rewrite rules now, and the error I get is "Secure Connection Failed. SSL_ERROR_UNRECOGNIZED_NAME_ALERT". </div>I'm going to try and google this, since I'm assuming I need a ServerAlias somewhere. If someone knows the correct way, please let me know :) </div><div class="gmail_extra"> <div><div class="gmail_signature" data-smartmail="gmail_signature">-Harry </div></div> <div class="gmail_quote">On 13 July 2016 at 08:11, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Harry Kashouli wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I tried uncommenting everything in the ipa-rewrite.conf file, but it still changed the web address. I'll try clearing the cache, in case that was still remembering the links. I may be attacking my original thought badly, if this is going to be bad for security. I'm wanting to allow users to change their passwords remotely, so I figured giving them public access to the Web UI was the way to go. Is there a better solution? </blockquote> Moving back to list. Getting the rewrite rules right can be tricky sometimes. You might have an easier time using a proxy instead. Exposing the UI increases the attack surface area so as usual it's a balance of security and convenience that you need to assess. A community portal was started last summer but has largely stalled. This is the long-term plan for what you're looking for. The design and a pointer to the current code is at <a href="https://www.freeipa.org/page/V4/Community_Portal" rel="noreferrer" target="_blank">https://www.freeipa.org/page/V4/Community_Portal</a> rob <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> -Harry On 11 July 2016 at 19:56, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a> <mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>> wrote: Harry Kashouli wrote: Hi all, I have a freeipa server set up, and would like to access the Web UI remotely (from outside my home network). I set up a fresh Fedora 24 server install, and installed freeipa-server. - I own a domain, <a href="http://domain.com" rel="noreferrer" target="_blank">domain.com</a> <<a href="http://domain.com" rel="noreferrer" target="_blank">http://domain.com</a>> <<a href="http://domain.com" rel="noreferrer" target="_blank">http://domain.com</a>> - The hostname of my freeipa server is <a href="http://hostname.subdomain.domain.com" rel="noreferrer" target="_blank">hostname.subdomain.domain.com</a> <<a href="http://hostname.subdomain.domain.com" rel="noreferrer" target="_blank">http://hostname.subdomain.domain.com</a>> <<a href="http://hostname.subdomain.domain.com" rel="noreferrer" target="_blank">http://hostname.subdomain.domain.com</a>> - My home network domain is <a href="http://subdomain.domain.com" rel="noreferrer" target="_blank">subdomain.domain.com</a> <<a href="http://subdomain.domain.com" rel="noreferrer" target="_blank">http://subdomain.domain.com</a>> <<a href="http://subdomain.domain.com" rel="noreferrer" target="_blank">http://subdomain.domain.com</a>> I set up a CNAME <a href="http://hostname.domain.com" rel="noreferrer" target="_blank">hostname.domain.com</a> <<a href="http://hostname.domain.com" rel="noreferrer" target="_blank">http://hostname.domain.com</a>> <<a href="http://hostname.domain.com" rel="noreferrer" target="_blank">http://hostname.domain.com</a>> and port forwardings, and I tested this works with nginx on the same machine; I can successfully see the nginx test page. I then assumed I could do the same with the freeipa Web UI, but when I navigate to <a href="http://hostname.domain.com" rel="noreferrer" target="_blank">http://hostname.domain.com</a>:<external_port>, it switches to <a href="https://hostname.subdomain.domain.com" rel="noreferrer" target="_blank">https://hostname.subdomain.domain.com</a>:<internal_port>, and with the following error: "Server not found" What am I doing wrong? Look at ipa-rewrite.conf in the IPA Apache config. It does rewriting to the real name of the IPA server when it was installed. You can try tweaking this to allow both names, or to just not do the rewriting. You may have issues with Kerberos and SSL due to using a different name. You definitely don't want to use IPA over an unsecure channel. rob </blockquote> </blockquote></div> </div>