VBR API returns 403 for swagger on everything except localhost in the url

[JaySt]

I'm lost on this one.
I've got a v12 (latest build) VBR server running on a non-domain-joined windows server. Enterprise Plus rental licenses active. It's properly registred to the DNS servers with FQDN, forward and reverse.
When i open the console and use it to open the swagger interface through the menu Console->Swagger, it opens on https://shortservername:9419/swagger/ui/index.html
The first time, it comes back with self signed certificate flow in the browser, and when accepted, a 403 is immediately displayed.
I'm doing this with a local administrator.

No matter what i put in the URL, every form of the hostname part results in a 403. So the API is listening, but it returns 403. EXCEPT when i use "localhost" or "127.0.0.1". Swagger is displayed in that case, but on https://127.0.0.1:9419/swagger which redirects to https://127.0.0.1:9419/swagger/ui/index (https://127.0.0.1:9419/swagger/ui/index.html failes with an swagger error "Swashbuckle.SwaggerUi.AssetNotFound").

anyone got an idea why the API would be returning the 403 on anything except localhost?

Goal is to use/read the API from another source and i keep thinking "this should... just work" .. but it doesn't (yet). Perhaps i'm missing something obvious and simple.

[david.domask]

Hi JaySt,

Seems like certificate issue at first blush, but I don't think we'll be able to give further guidance without review of the debug logs. You might try checking the dev console for errors if you want to try it yourself, but it's really best to open a Support Case and let Veeam Support review.

[JaySt]

yes, i dove into the certs. It's just the self signed certs made during installation. tried to create a new one (with all the names of the server) and assign them to the 0.0.0.0:9419 and applicable application id, like the docs mention, but restart of the API services just revert that back to the default cert assigned to the VBR server. Odd.

Svc.PlatformDbProvider.log shows "Forbidden hostname x.x.x.x" when i open the swagger on https://shortservername:9419/swagger/ui/index.html

Just looking to see if someone saw this before or knows where to look for clues further.
i'll take this up with support as well in short term.

[david.domask]

Aha, got it. I am not sure where to point you here based just on this but still seems like certs.

Please share your case number once created.

Thanks!

[JaySt]

ok ... eventually a (old) bell rang within my own head. It's fixed.
Somehow, a dword value named "Port" within HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Backup and Replication\API\DbProvider is set with "9419" (decimal).
From the past, with a bit of similar issue (but not identical), i remembered this had (or should have) a different value.
I changed the value to 6172 (decimal) and restarted all veeam services (rebooted actually).

works like expected now!

[david.domask]

Hey, great to hear it

Thanks for sharing your solution -- 9419 is actually the default port, so perhaps something else was listening on 9419?

Regardless, I think it should be okay.

[JaySt]

I dont fully get it either. But it worked.

[eeberg]

Swagger is the front-end for the REST API, listening by default on 9419. REST API interfaces with VBR's DB. If the DB port is incorrect, REST can't connect to the DB and will not work properly. 6172 is the default port. Reference https://www.veeam.com/kb4687.

[david.domask]

Well, yes that's about plugin services, but regardless I have a pretty good idea what was happening now, and if there were issues getting to the proper service due to the incorrect port set for the plugin services w/ the config parameter, the 403's make sense.

[JaySt]

Not sure why that value was there. Perhaps some historic artifact from older versions. Is it present by default?