I have a need to access sabnzbd externally via API, but I would like to disable the web gui / login screen. Reading the documentation, this should be straighforward with the "External Internet Access" settings. On my setup, this was/is set to none (although API access continued to work) but I still get the login screen when accessing my WAN IP and port externally.
I updated to v 4.01 today in case it was a bug but I can still hit the logon screen from the internet.
Its been years since I set this up and may have fiddled with some settings. Where should I be looking to get the web interface blocked from the internet?
Cheers
Mike
Can't disable web interface on internet
Forum rules
Help us help you:
Help us help you:
- Are you using the latest stable version of SABnzbd? Downloads page.
- Tell us what system you run SABnzbd on.
- Adhere to the forum rules.
- Do you experience problems during downloading?
Check your connection in Status and Interface settings window.
Use Test Server in Config > Servers.
We will probably ask you to do a test using only basic settings. - Do you experience problems during repair or unpacking?
Enable +Debug logging in the Status and Interface settings window and share the relevant parts of the log here using [ code ] sections.
Can't disable web interface on internet
Last edited by mkeybhoy on May 30th, 2023, 2:13 pm, edited 1 time in total.
Re: Can't disable web interface on internet
What do you have set for local_ranges in Config Specials?
It seems the way you have setup the forward it's not detected as external traffic. The only thing we have to go on is the ip address that we get.
You can also enable Debug logging in the Status window and then try it again and login externally.. Then we can inspect the logs.
Just double checking that you perform this test really externally from your network, for example from your phone on a mobile network?
It seems the way you have setup the forward it's not detected as external traffic. The only thing we have to go on is the ip address that we get.
You can also enable Debug logging in the Status window and then try it again and login externally.. Then we can inspect the logs.
Just double checking that you perform this test really externally from your network, for example from your phone on a mobile network?
If you like our support, check our special newsserver deal or donate at: https://sabnzbd.org/donate
Re: Can't disable web interface on internet
From sabnzbd.ini, my local ranges entry is
local_ranges = ,
and yes, I access the logon page on 5G on my phone and turn off wifi
local_ranges = ,
and yes, I access the logon page on 5G on my phone and turn off wifi
Re: Can't disable web interface on internet
Alright, then let's enable Debug logging and you can login once and send the logs to me at [email protected]
If you like our support, check our special newsserver deal or donate at: https://sabnzbd.org/donate
Re: Can't disable web interface on internet
That's been emailed over. Cheers
Re: Can't disable web interface on internet
I noticed the debug log contains the username and password in clear text so I've changed the password since the logs were sent over.
Re: Can't disable web interface on internet
This got me thinking. Sabnzbd runs in Docker on a Synology NAS sat on the LAN. I port forward 8080 on the router to the ip and local port of the container running sab - 192.168.x.y:3xxxx and a further translate looks to occur in the Synology Docker - local port to the container port of sabnzbd (3xxxx->8080).
I wonder if this second translation is making the ip address appear to be from the LAN rather than WAN?
Re: Can't disable web interface on internet
Sorry I didn't see the logs, they went into my spam. Hope to check them some time today or tomorrow!
If you like our support, check our special newsserver deal or donate at: https://sabnzbd.org/donate
Re: Can't disable web interface on internet
The logs show as remote address:
Maybe I need the help of Sander here..
Code: Select all
2023-05-30 19:32:07,006::DEBUG::[interface:141] Request GET /api from ::ffff:172.17.0.1 [Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Mobile Safari/537.36] {'mode': 'showlog', 'apikey':<APIKEY>'}
If you like our support, check our special newsserver deal or donate at: https://sabnzbd.org/donate
Re: Can't disable web interface on internet
::ffff:172.17.0.1 is ipv6 notation of 172.17.0.1
and 172.17.0.1
So a private range from RFC1918, just like 192.168.x.y.
If you Google 172.17.0.1 and Docker, one of the hits is "the IP address of the gateway between the Docker host and the bridge network ( 172.17.0.1 )."
So indeed a docker thing. Apparently, the Docker setup of OP does address translastion. So SAB cannot see it's external traffic.
and 172.17.0.1
Code: Select all
$ whois 172.17.0.1 | grep -i Netname
NetName: PRIVATE-ADDRESS-BBLK-RFC1918-IANA-RESERVED
If you Google 172.17.0.1 and Docker, one of the hits is "the IP address of the gateway between the Docker host and the bridge network ( 172.17.0.1 )."
So indeed a docker thing. Apparently, the Docker setup of OP does address translastion. So SAB cannot see it's external traffic.
Re: Can't disable web interface on internet
But, wait:
When I start sab-in-docker on my VPS with
and then access it from remote, SAB does nicely say:
so: external, public IP address. p
Plus SAB refuses it:
So in this case, SAB-in-docker does see it as external access and refuses it
So the OP must have a different docker setup. Mabye my setup could work for him?
EDIT
FWIW:
On my VPS, there is a 172.17.0.1 address for docker:
When I start sab-in-docker on my VPS with
Code: Select all
sudo docker run -p 8080:8080 lscr.io/linuxserver/sabnzbd:latest
Code: Select all
2023-06-01 20:35:04,347::WARNING::[interface:374] Refused connection from: ::ffff:87.162.6.6 [Mozilla/5.0 (X11; CrOS x86_64 14816.131.5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36]
Plus SAB refuses it:
Code: Select all
External internet access denied - https://sabnzbd.org/access-denied
So the OP must have a different docker setup. Mabye my setup could work for him?
EDIT
FWIW:
On my VPS, there is a 172.17.0.1 address for docker:
Code: Select all
$ ifconfig | head -2
docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
Re: Can't disable web interface on internet
Thank you both for taking the time to look at this. I've taken a look at the docker config on the Synology, and when creating the container from an image there is an option to use the same network as the docker host (instead of a bridge).
I've done this and now get
External internet access denied - https://sabnzbd.org/access-denied
When accessing over 5G. Mission accomplished.
Cheers
I've done this and now get
External internet access denied - https://sabnzbd.org/access-denied
When accessing over 5G. Mission accomplished.
Cheers