MeshCentral via Citrix NetScaler Reverse Proxy

[tobias9931]

Hello everyone,
does anyone have experience in operate MeshCentral via Citrix NetScaler Reverse Proxy?
MeshCentral works perfectly in our internal network.
Now we would also like to allow MeshCentral agents from the Internet to connect to our server.
This does not seem to work at the moment at our site.

How can I carry out a point-by-point troubleshooting?
What can I check? Log files, queries etc?
Can I check whether a connection has not yet been released on the reverse proxy or whether the MeshCentral server sees the request from the agent but rejects it for some reason?

Best regards
Tobias

[si458]

meshcentral does not support split dns with different ssl certs OR multiple dns entries.
what you need to do is make sure your internal network talks to the same DNS name that your external devices talk to

the DNS values can map to different IP addresses if your using split DNS
mesh.mydomain.com -> 192.168.9.88 - internal DNS
mesh.mydomain.com -> 1.2.3.4 (which forwards to 192.168.9.88) - external DNS
but both devices MUST get the SAME ssl certificate from your reverse proxy

[tobias9931]

Funny, ChatGPT says I don't need to set certUrl

You do not need to specify a certUrl in config.json unless you have a complicated setup architecture with split certificates or download URLs.
→ Standard case: The cert field in MeshCentral must match the certificate, but the certificate itself is located at the proxy or in the web server that is in front of MeshCentral.
Do I have to specify certUrl?	No, only if agents should explicitly load the certificate from a different location (rare).

but anyway, I've set it now

[tobias9931]

But then everything has to fit from the configuration side in MeshCentral, right?

What else can I test step by step?
For the agents that are currently external:

C:\Program Files\Company Group\Mesh Agent>Companymeshagent.exe -state
Querying Mesh Agent state...
Unable to contact Mesh Agent...

[tobias9931]

Is https://piehost.com/websocket-tester a valid way to check if the WebSocket connection is working?
With a browser in the internal network I can connect to wss://meshcentral.company.cloud:443/agent.ashx.
I cannot connect with a browser on the external Internet.
But maybe a security setting on the firewall prohibits this

[tobias9931]

One more addition.
My server does not normally have an internet connection.
Previously, when the server was restarted and the MeshCentral service was restarted, this always worked without an internet connection.
"certUrl": “https://meshcentral.company.cloud”, will not kill it now if there is no internet connection at the time?

[tobias9931]

Do you have any tips on which log files I can test on the client or whether the WebSocket connection is working etc.? @si458