How does the web UI decide which IPs are local (no login) and remote (requires auth)

Channels DVR Server
#1

Long story short I have a Channels instance set up and working great. But I switched to an ISP that doesn’t allow port forwarding. Annoying. Because I’m enough of a nerd I’ve set up a VPN server on a cloud server instance and have my local server connecting to it. That cloud server then exposes port 8089 to the internet. And it works!

But. It doesn’t prompt for auth. So my whole DVR is accessible to anyone with the IP (don’t worry, I’ve shut it off for now). I assume this is because the Channels server sees the traffic as arriving from an internal IP and so doesn’t require auth. Is there any setting I can tweak somewhere where I could override this and say a certain IP is always external? Or failing that, just require auth every time no matter where the client is?

#2

Correct.

You could setup a reverse proxy and inject this header: X-DVR-ForceAuth: true

1 Like
#3

Local—and therefore, non-authenticated—IPs come from RFC1918, and are: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Those addresses are always considered local, and should never be addressable across the internet.