# Web unsecure connection

**URL:** <https://forum.pritunl.com/t/web-unsecure-connection/346>\
**Category:** Pritunl\
**Tags:** pritunl, pritunl-cloud\
**Created:** [August 30, 2022, 5:54pm UTC](https://forum.pritunl.com/t/web-unsecure-connection/346 "2022-08-30T17:54:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![diego.b](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/d/7cd45c/32.png) [@diego.b](https://forum.pritunl.com/u/diego.b)\
**Post date:** [August 30, 2022, 5:54pm UTC](https://forum.pritunl.com/t/web-unsecure-connection/346/1 "2022-08-30T17:54:50Z")

</div>

Currently, we have VPN locally hosted, both ports 80 and 443 are port forwarded.  
One of our concerns is that when using the WAN IP to access the web page it shows the login page with unsecure access via https. How can we limit this to redirect to our actual subdomain name instead of showing this page when someone tries to access it?

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [August 30, 2022, 9:11pm UTC](https://forum.pritunl.com/t/web-unsecure-connection/346/2 "2022-08-30T21:11:11Z")

</div>

A valid certificate needs to be configured to allow HTTPS access without the certificate error. The [**Lets Encrypt support**](https://docs.pritunl.com/docs/letsencrypt-ssl-certificate) can be used to configure this.

---

<div class="post-metadata">

**Author:** ![diego.b](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/d/7cd45c/32.png) [@diego.b](https://forum.pritunl.com/u/diego.b)\
**Post date:** [August 31, 2022, 12:38am UTC](https://forum.pritunl.com/t/web-unsecure-connection/346/3 "2022-08-31T00:38:08Z")

</div>

I meant accessing it via WAN IP instead of the domain name, my SSL certificate is working.  
For example if I try to access the server via [https://000.000.000.000](https://000.000.000.000) it is still visible and not redirected or unavailable.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [August 31, 2022, 12:55am UTC](https://forum.pritunl.com/t/web-unsecure-connection/346/4 "2022-08-31T00:55:32Z")

</div>

You would need to configure an external web server that could handle that redirection. Blocking web access from the IP address without a domain correctly configured could break the Pritunl Client. Unless the sync address is set in the Pritunl host settings it will fallback to the host public address. If these are both IP addresses the Pritunl Client will not be able to sync the configuration. Dynamic firewall and WireGuard connections are also done using the sync address.

---

<div class="post-metadata">

**Author:** ![diego.b](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/d/7cd45c/32.png) [@diego.b](https://forum.pritunl.com/u/diego.b)\
**Post date:** [November 2, 2022, 8:45pm UTC](https://forum.pritunl.com/t/web-unsecure-connection/346/5 "2022-11-02T20:45:39Z")

</div>

I will re-elaborate on my previous question.  
Am I able only allow the server port used to connect through port forwarding and limit any other access unless the domain name is used to access the web interface?  
I want to prevent direct access to port 80 and port 443 and use my proxy manager instead.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [November 2, 2022, 9:41pm UTC](https://forum.pritunl.com/t/web-unsecure-connection/346/6 "2022-11-02T21:41:07Z")

</div>

There’s no options in Pritunl to force access from only specific domain names. It will always accept HTTP traffic on the web ports. You would need to configure this externally with a reverse proxy.