Omnissa UAG via Netbird

So in the past I wrote this article about using Cloudflare to access your UAG but I have recently been testing out Netbird mainly for another project that I will write up soon. I still use and love Cloudflare but myself and another friend had a authentication requirement where this just worked better so curiosity got the better of me so I thought I would try and get this to work.

In principle the steps are fairly similar and for this specific post I have made a few assumptions:-

• You have already created a Netbird tenant using their online plan
• There is a machine that you can install the agent on which can route to the required networks
• I have tested this with both version but you will need a spare public IP if hosting this yourself
• At the time of writing this article reverse proxy is in beta and free of charge

As always remember security first and this guide is not 100% extensive in showing all the lockdown options

• I would not suggest this in a production environment as its not supported
• This was for Lab testing and emergency access
• Please check your security just to limit exposure
• This will only work for HTML access or tested with this at present, the client wont work
• Again I would not recommend this but you could also point this to one of your connection brokers

Netbird Configuration

From within the Peers option with need to Add Peer and then select Agent

From within here copy the top command and run this on your machine that will be the routing agent

Click the Generate Key and copy the second command, you should see the prompt connected within the terminal. You should also now see this in the peer list

We now need to create a network that we want to map and eventually route to

Enter a name for your network

Once you have selected Add Network, Select Add Resource on the next screen

Again follow the on screen prompts with your information, for my uses I put in a CIDR block and hit continue

You can add some controls here but for the demo I have omitted this

If you do this you will get the below prompt

From here we want to adding the routing peer

Select your node and continue

I left these items as default

We now need to create a route for our subnet with our UAG(s) within the Network Routing and then Routes from the menu and select Add Route

From here enter the subnet you did earlier and again select your peer again

For simplicity I selected all but you can lock this down if required

Again enter a name if you need to follow logs in the future

I left these setting as default but these are what worked for me

Now we are on to the fun bit where we can create the tunnel! Open the reverse proxy tab and Add Service

Within here enter a URL you wish to us, again I am using the out of the box URL and these are shared with others so you may need to find something unique unless you have already added a customer domain

We now need to select add target and from here resources and the subnet we created earlier

In here we need to put in our UAG address and ensure HTTPS is selected, I also found I selected skip TLS verification incase I had any underlying certificate issues helped things along

You will now see the following screen, for simplicity I normally have a password here as you need an AD account once you get past this anyway

In the final window I also found I needed to select Pass Host Header to get things to respond as I wanted

If you have not selected any protection you will get the below prompt

If all has gone well you should now see your tunnel has been created!

UAG Configuration

We need to get into the Horizon UAG settings, Expand out the Edge Service Settings and then select the cog for configuration. Expand out the settings and find the additional Blast External URLs and Tunnel URLs, add an alternative name that your have hosted via your Netbird Tunnel, ensure you save the config.

Below is how my system is set up and in the additional blast URLS I needed to have the proxy tunnel url in this format proxy.domain.com:443 and same for the additional tunnel urls https://proxy.domain.com:443

I also found I need to select the following options to get things to tunnel as expected

Click save and when the UAG refreshes you should now hopefully get the below!

If you add security!

Quite simply you get the below!

And the end to end using the tunnel 🙂

I hope that this helps out people and again a similar setup should work if you end up using Netbird as your VPN back to your lab this way you can use any HTTPS browser for access