# ProxyTunnel 407 Error when using ACME certificate **URL:** \ **Category:** openBalena\ **Created:** [May 7, 2020, 8:36am UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753 "2020-05-07T08:36:44Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![bighair](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/bighair/32/1508_2.png) [@bighair](https://forums.balena.io/u/bighair)\ **Post date:** [May 7, 2020, 8:36am UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/1 "2020-05-07T08:36:44Z")
Hello, I followed the getting started guide to build an openBalena server at aws using an “off the shelf” Ubuntu image. I successfully managed to setup proxytunnel on my machine to get ssh access to my devices both for development and production balenaOS images. Happy Dayz! Given this success I thought I’d have a crack at setting up a service that was a bit more robust and in line with my estate policies so I pulled the test environment down and started again with my own Centos7 image. With a bit of trial and error I’ve got to a point where the service is up and running, this time using the ACME cert provider service. I can connect and query devices using the CLI so this is all good. The only thing I can’t get working is the ssh tunnelling (either to a dev or a prod balenaOS image). Specifically, when I try “ssh root@.balena” I get the standard “Via vpn.\<[mydomain.com](http://mydomain.com)\>:3128 -\> .balena:22222” message and then it throws: “HTTP return code: 407 Proxy Authorization Required” Looking in the vpn service logs on the openBalena server side it’s saying the device is unreachable but I can see earlier in the log the device connected and authenticated successfully. I’ve tried turning off firewalls opening up security groups to no avail. Can anyone give me any pointers for where to look next? ---
**Author:** ![karaxuna](https://avatars.discourse-cdn.com/v4/letter/k/e480ec/32.png) [@karaxuna](https://forums.balena.io/u/karaxuna)\ **Post date:** [May 7, 2020, 10:50am UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/5 "2020-05-07T10:50:55Z")
Hi, can you check if the device is online via api request or cli? ---
**Author:** ![bighair](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/bighair/32/1508_2.png) [@bighair](https://forums.balena.io/u/bighair)\ **Post date:** [May 7, 2020, 12:18pm UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/7 "2020-05-07T12:18:11Z")
Thanks @karaxuna, Yes, I’ve got 3 registered devices on the server at the moment and they all show as online through the CLI. One of them has a dev image on it so I can ssh locally and when I block the openBalena ports on the server it drops connection, when I open the ports again they all reconnect as expected. ---
**Author:** ![AlidaOdendaal](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/alidaodendaal/32/1641_2.png) [@AlidaOdendaal](https://forums.balena.io/u/AlidaOdendaal)\ **Post date:** [May 7, 2020, 1:45pm UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/10 "2020-05-07T13:45:30Z")
Hi @bighair Great, now can you please try the following on the command line: ```auto balena tunnel {uuid} -p 22222:22222 ``` replacing `{uuid}` with the UUID of your device, to make your `localhost:22222` tunnel through to the device’s port `22222` (this is the port SSH runs on). Then, try ```auto ssh -p 22222 -l root 127.0.0.1 ``` to see if SSH connects. Please let us know if it works! Kind regards Alida ---
**Author:** ![bighair](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/bighair/32/1508_2.png) [@bighair](https://forums.balena.io/u/bighair)\ **Post date:** [May 7, 2020, 2:36pm UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/12 "2020-05-07T14:36:36Z")
Thanks Alida, I think we’re getting somewhere. Across all three devices (2 prod, 1 dev) I get the following error when trying the tunnel steps you’ve suggested: `[Error] 127.0.0.1:63888 => 127.0.0.1:22222 ===> 10.240.0.3:22222 :: Device is not listening on port 22222` Does this suggest I need to do something with the image before flashing it to the SD card? ---
**Author:** ![bighair](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/bighair/32/1508_2.png) [@bighair](https://forums.balena.io/u/bighair)\ **Post date:** [May 7, 2020, 4:31pm UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/13 "2020-05-07T16:31:56Z")
I took this error and have tested out a few more things: - `netstat -ant | grep 22222` from one balena device shows: > tcp 0 0 :::22222 :::\* LISTEN > tcp 0 0 ::ffff:192.168.3.23:22222 ::ffff:192.168.5.7:65370 ESTABLISHED - `telnet 3128` from my laptop is successful (i.e. it connects and I get a telnet terminal prompt) - `telnet 3128` from one of my balena devices doesn’t seem to work at all (i.e. it doesn’t connect and I don’t get a telnet terminal prompt) This suggest to me that my devices are listening on port 22222 but for some reason they can’t access port 3128 on my server. Although my laptop can even when I have it on the same network as the devices. The only wrinkle is that I can’t see any errors when I query journalctl: - `journalctl -au openvpn` (all looks good and certainly the data channels appear to be up) - `journalctl -au resin-supervisor` (again, no issues) ---
**Author:** ![bighair](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/bighair/32/1508_2.png) [@bighair](https://forums.balena.io/u/bighair)\ **Post date:** [May 8, 2020, 6:26am UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/14 "2020-05-08T06:26:30Z")
OK, so I’ve done more digging and it turns out that certainly one of my problems was the firewall on my server host machine. I could ping [www.google.com](http://www.google.com) from the host but not from any of the openBalena containers. Turning the firewall off `systemctl stop firewalld` on the host server and restarting Docker and openBalena proved it. I then ran the below to make the changes to the host server firewall that allows it to run whilst still letting the container traffic out: - `firewall-cmd --permanent --zone=trusted --change-interface=docker0` I did need to restart the whole server again after the above command, but I’m not sure that’s fully necessary. You would definitely need to restart Docker and the openBalena containers though. After making the above change I could successfully tunnel using the `balena tunnel {uuid} -p 22222:22222` command. However, the proxytunnel approach still doesn’t work and I get the same 407 error as in my first post? ---
**Author:** ![dfunckt](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/dfunckt/32/56_2.png) [@dfunckt](https://forums.balena.io/u/dfunckt)\ **Post date:** [May 8, 2020, 7:58am UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/15 "2020-05-08T07:58:09Z")
Can you try the tunnel approach with the dev device first? I suspect the production ones won’t let you connect unless you add a key to them. ---
**Author:** ![bighair](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/bighair/32/1508_2.png) [@bighair](https://forums.balena.io/u/bighair)\ **Post date:** [May 8, 2020, 11:00pm UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/17 "2020-05-08T23:00:15Z")
Hi there, This was completely my bad! I’d setup proxytunnel as per the instructions here [HowTo: SSH into host device](https://forums.balena.io/t/howto-ssh-into-host-device/5312) for my proof of concept host server / service. I hadn’t re-run the `balena api-key generate proxytunnel` command and so I was still using the old credentials in my ~/.ssh/balena-ssh file. I re-ran the api-key generate command, applied the new key and I’m back in business. Thanks so much for all your help. ---
**Author:** ![xginn8](https://avatars.discourse-cdn.com/v4/letter/x/8baadc/32.png) [@xginn8](https://forums.balena.io/u/xginn8)\ **Post date:** [May 8, 2020, 11:01pm UTC](https://forums.balena.io/t/proxytunnel-407-error-when-using-acme-certificate/106753/18 "2020-05-08T23:01:08Z")
Thanks for getting back to us, and we’re glad to hear you’ve sorted it out!