Cwa-website: FAQ: Add entry for domains that need to be whitelisted by firewall

[heinezen]

See https://github.com/corona-warn-app/cwa-documentation/issues/458 for an example. The issue is that company firewalls might prevent the CWA from contacting the backend. We can link the document and required domains from my comment in the linked issue.

[MikeMcC399]

@heinezen

See corona-warn-app/cwa-documentation#458 for an example. The issue is that company firewalls might prevent the CWA from contacting the backend. We can link the document and required domains from my comment in the linked issue.

Good idea to put this topic in the FAQ list!

The document backend-infrastructure-architecture.pdf is quite complex and difficult to understand though, just to extract firewall settings. It also covers a lot more than just the production environment and what needs to be reachable for mobile devices.

I suspect that the relevant Content Delivery Network (CDN) URLs to allow mobile devices access to the CWA servers are:

• from the file prod_environments.json and
• from the language files strings.xml, etc. for displaying FAQ text relating to app error messages where https://www.coronawarn.app is referenced.

Name | URL
---|---
DOWNLOAD_CDN_URL | https://svc90.main.px.t-online.de |
SUBMISSION_CDN_URL | https://submission.coronawarn.app
VERIFICATION_CDN_URL | https://verification.coronawarn.app
errors_google_api_error (German) | https://www.coronawarn.app/de/faq/
errors_google_api_error (English and all other languages) | https://www.coronawarn.app/en/faq/

So I believe in summary, this reduces to firewalls allowing the following access:

Domain / Access point| port
--- | ---
*.coronawarn.app | 443
svc90.main.px.t-online.de | 443

The above table is simpler than referring to the table 3.2.5 in backend-infrastructure-architecture.pdf.

Also should we list what happens for each URL when accessed directly through a browser? That is blank page for https://svc90.main.px.t-online.de, Whitelabel Error Page for https://submission.coronawarn.app & https://verification.coronawarn.app and display of FAQs for https://www.coronawarn.app/de/faq/ & https://www.coronawarn.app/en/faq/.

Maybe we could get network specialists to double-check the firewall table?

[MikeMcC399]

I picked up the URL https://svc90.main.px.t-online.de/version/v1/diagnosis-keys/country/DE/date from https://github.com/corona-warn-app/cwa-documentation/issues/311#issuecomment-646500156. The t-online URL displays a list of dates, as a check about whether connectivity to the download server is working.

Or from https://github.com/corona-warn-app/cwa-server/raw/master/services/distribution/api_v1.json perhaps https://svc90.main.px.t-online.de/version/v1/diagnosis-keys/country is better as a test URL? It results in ["DE","EUR"].

[heinezen]

@MikeMcC399

Thank you. However, I think your aggregated table goes a little too far in generalizing the domains. Using wildcards in firewwalls is not considered best practice in a lot of companies. So we should not casually suggest that in the official FAQ. Furthermore, listng the API endpoints is necessary if one wants to create more specific rules. Section 3.2.5 in the PDF provides all the information necessary to craft strict rules, so I would still prefer linking that with an explanatory text.

Also should we list what happens for each URL when accessed directly through a browser?

Most of these are not supposed to be accessed through the browser. They provide a REST API which is accessed by the app to download content.

---

Corona-Warn-App Open Source Team

[MikeMcC399]

@heinezen

Section 3.2.5 in the PDF provides all the information necessary to craft strict rules, so I would still prefer linking that with an explanatory text.

I understand about you preferring to be specific rather than wildcarding.

The table 3.2.5 in backend-infrastructure-architecture.pdf doesn't however list
svc90.main.px.t-online.de or
www.coronawarn.app.
At least the t-online.de domain would be essential. The www.coronawarn.app only comes into play in error situations.

So I think an additional table is needed to include all necessary end points, if 3.2.5 doesn't contain the full list.

[MikeMcC399]

The original answer from the Open Source Team @jakobmoellersap in https://github.com/corona-warn-app/cwa-app-android/issues/785#issuecomment-651576989 was:

Please try to whitelist

*.coronawarn.app
*.t-online.de
These are the URLs used by Corona-Warn-App to do network communication

[heinezen]

@MikeMcC399 I discovered that an internal document contains the correct domains, so the PDF ist just outdated. I'll try to get the PDF updated so that the information is correct again.

---

Corona-Warn-App Open Source Team

[dsarkar]

@MikeMcC399, @heinezen, @vaubaehn: Feedback from devs is, to use the word "access-list".

Suggestion for FAQ entry based on your and other´s contributions:

Title for FAQ entry: Firewall/Router configuration: URSACHE: 4000, error during web request, http status 901

"
Some company firewalls might prevent the CWA from contacting the backend. This might lead to error notifications, including URSACHE: 4000, error during web request, HTTP status 901. In case you make use of a firewall (router or app), make sure to include the following domains in the access-list for web requests as well as for DNS requests.:

• *.coronawarn.app
• *.t-online.de

"

Best wishes,
DS

---

Corona-Warn-App Open Source Team

[MikeMcC399]

@dsarkar

If you can correct two typos, then that looks fine:

inlcude => include
acess-list => access-list

also, I would write:

as well for DNS requests. => as well as for DNS requests.

[dsarkar]

@MikeMcC399 done. Thanks.

[dsarkar]

@MikeMcC399 @heinezen

Suggestion for DE-FAQ entry based on your and other´s contributions:

• Title for FAQ entry: Firewall/Router Konfiguration: URSACHE: 4000, error during web request, http status 901

Text:
"
Einige Firmen-Firewalls verhindern möglicherweise den Zugriff der CWA auf das Backend. Das kann in eigenen Fällen zu einer Fehlermeldung führen unter anderem URSACHE: 4000, error during web request, HTTP status 901. Sollten sie eine Firewall benutzen (Router oder App) versichern vergewissern sie sich, dass die folgenden Domains in der Access-Liste für Web- und den DNS-Requests berücksichtigt sind:

*.coronawarn.app
*.t-online.de
"

[vaubaehn]

Hi,
I would suggest to skip the specialisation of 'company Firewalls' / 'Firmen-Firewalls' as we have seen from the related issues that also consumer hardware or apps might need to be configured. So just use 'Firewall' instead.
How does this sound for you?

[dsarkar]

@vaubaehn, sounds good to me. Thanks! DS

[dsarkar]

DE

Firewall/Router Konfiguration: URSACHE: 4000, error during web request, HTTP status 901

Einige Firewalls verhindern möglicherweise den Zugriff der CWA auf das Backend. Das kann in eigenen Fällen zu einer Fehlermeldung führen, unter anderem "URSACHE: 4000, error during web request, HTTP status 901". Sollten sie eine Firewall benutzen (Router oder App) versichern vergewissern sie sich, dass die folgenden Domains in der Access-Liste für Web- und den DNS-Requests berücksichtigt sind:

*.coronawarn.app
*.t-online.de

---

EN

Firewall/Router configuration: URSACHE: 4000, error during web request, HTTP status 901

Some firewalls might prevent the CWA from contacting the backend. This might lead to error notifications, including URSACHE: 4000, error during web request, HTTP status 901. In case you make use of a firewall (router or app), make sure to include the following domains in the access-list for web requests as well as for DNS requests.:

*.coronawarn.app
*.t-online.de

---

Best wishes,
DS

---

Corona-Warn-App Open Source Team

[MikeMcC399]

"in eigenen Fällen" => "in einigen Fällen"

"versichern vergewissern sie sich" => "vergewissern sie sich"

In English text:
"URSACHE" => "CAUSE"