Can't disable web interface on internet

Get help with all aspects of SABnzbd
Forum rules
Help us help you:
  • Are you using the latest stable version of SABnzbd? Downloads page.
  • Tell us what system you run SABnzbd on.
  • Adhere to the forum rules.
  • Do you experience problems during downloading?
    Check your connection in Status and Interface settings window.
    Use Test Server in Config > Servers.
    We will probably ask you to do a test using only basic settings.
  • Do you experience problems during repair or unpacking?
    Enable +Debug logging in the Status and Interface settings window and share the relevant parts of the log here using [ code ] sections.
Post Reply
mkeybhoy
Newbie
Newbie
Posts: 11
Joined: November 8th, 2011, 9:18 am

Can't disable web interface on internet

Post by mkeybhoy »

I have a need to access sabnzbd externally via API, but I would like to disable the web gui / login screen. Reading the documentation, this should be straighforward with the "External Internet Access" settings. On my setup, this was/is set to none (although API access continued to work) but I still get the login screen when accessing my WAN IP and port externally.

I updated to v 4.01 today in case it was a bug but I can still hit the logon screen from the internet.

Its been years since I set this up and may have fiddled with some settings. Where should I be looking to get the web interface blocked from the internet?

Cheers

Mike
Last edited by mkeybhoy on May 30th, 2023, 2:13 pm, edited 1 time in total.
User avatar
safihre
Administrator
Administrator
Posts: 5338
Joined: April 30th, 2015, 7:35 am
Contact:

Re: Can't disable web interface on internet

Post by safihre »

What do you have set for local_ranges in Config Specials?
It seems the way you have setup the forward it's not detected as external traffic. The only thing we have to go on is the ip address that we get.
You can also enable Debug logging in the Status window and then try it again and login externally.. Then we can inspect the logs.

Just double checking that you perform this test really externally from your network, for example from your phone on a mobile network?
If you like our support, check our special newsserver deal or donate at: https://sabnzbd.org/donate
mkeybhoy
Newbie
Newbie
Posts: 11
Joined: November 8th, 2011, 9:18 am

Re: Can't disable web interface on internet

Post by mkeybhoy »

From sabnzbd.ini, my local ranges entry is

local_ranges = ,

and yes, I access the logon page on 5G on my phone and turn off wifi
User avatar
safihre
Administrator
Administrator
Posts: 5338
Joined: April 30th, 2015, 7:35 am
Contact:

Re: Can't disable web interface on internet

Post by safihre »

Alright, then let's enable Debug logging and you can login once and send the logs to me at [email protected]
If you like our support, check our special newsserver deal or donate at: https://sabnzbd.org/donate
mkeybhoy
Newbie
Newbie
Posts: 11
Joined: November 8th, 2011, 9:18 am

Re: Can't disable web interface on internet

Post by mkeybhoy »

That's been emailed over. Cheers
mkeybhoy
Newbie
Newbie
Posts: 11
Joined: November 8th, 2011, 9:18 am

Re: Can't disable web interface on internet

Post by mkeybhoy »

I noticed the debug log contains the username and password in clear text so I've changed the password since the logs were sent over.
mkeybhoy
Newbie
Newbie
Posts: 11
Joined: November 8th, 2011, 9:18 am

Re: Can't disable web interface on internet

Post by mkeybhoy »

safihre wrote: May 30th, 2023, 1:07 am
It seems the way you have setup the forward it's not detected as external traffic. The only thing we have to go on is the ip address that we get.
This got me thinking. Sabnzbd runs in Docker on a Synology NAS sat on the LAN. I port forward 8080 on the router to the ip and local port of the container running sab - 192.168.x.y:3xxxx and a further translate looks to occur in the Synology Docker - local port to the container port of sabnzbd (3xxxx->8080).

I wonder if this second translation is making the ip address appear to be from the LAN rather than WAN?
User avatar
safihre
Administrator
Administrator
Posts: 5338
Joined: April 30th, 2015, 7:35 am
Contact:

Re: Can't disable web interface on internet

Post by safihre »

Sorry I didn't see the logs, they went into my spam. Hope to check them some time today or tomorrow!
If you like our support, check our special newsserver deal or donate at: https://sabnzbd.org/donate
User avatar
safihre
Administrator
Administrator
Posts: 5338
Joined: April 30th, 2015, 7:35 am
Contact:

Re: Can't disable web interface on internet

Post by safihre »

The logs show as remote address:

Code: Select all

2023-05-30 19:32:07,006::DEBUG::[interface:141] Request GET /api from ::ffff:172.17.0.1 [Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Mobile Safari/537.36] {'mode': 'showlog', 'apikey':<APIKEY>'}
Maybe I need the help of Sander here..
If you like our support, check our special newsserver deal or donate at: https://sabnzbd.org/donate
User avatar
sander
Release Testers
Release Testers
Posts: 8811
Joined: January 22nd, 2008, 2:22 pm

Re: Can't disable web interface on internet

Post by sander »

::ffff:172.17.0.1 is ipv6 notation of 172.17.0.1

and 172.17.0.1

Code: Select all

$ whois 172.17.0.1 | grep -i Netname
NetName:        PRIVATE-ADDRESS-BBLK-RFC1918-IANA-RESERVED
So a private range from RFC1918, just like 192.168.x.y.

If you Google 172.17.0.1 and Docker, one of the hits is "the IP address of the gateway between the Docker host and the bridge network ( 172.17.0.1 )."

So indeed a docker thing. Apparently, the Docker setup of OP does address translastion. So SAB cannot see it's external traffic.
User avatar
sander
Release Testers
Release Testers
Posts: 8811
Joined: January 22nd, 2008, 2:22 pm

Re: Can't disable web interface on internet

Post by sander »

But, wait:

When I start sab-in-docker on my VPS with

Code: Select all

sudo docker run  -p 8080:8080 lscr.io/linuxserver/sabnzbd:latest
and then access it from remote, SAB does nicely say:

Code: Select all

2023-06-01 20:35:04,347::WARNING::[interface:374] Refused connection from: ::ffff:87.162.6.6 [Mozilla/5.0 (X11; CrOS x86_64 14816.131.5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36]
so: external, public IP address. p
Plus SAB refuses it:

Code: Select all

External internet access denied - https://sabnzbd.org/access-denied
So in this case, SAB-in-docker does see it as external access and refuses it

So the OP must have a different docker setup. Mabye my setup could work for him?

EDIT

FWIW:

On my VPS, there is a 172.17.0.1 address for docker:

Code: Select all

$ ifconfig | head -2
docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
mkeybhoy
Newbie
Newbie
Posts: 11
Joined: November 8th, 2011, 9:18 am

Re: Can't disable web interface on internet

Post by mkeybhoy »

Thank you both for taking the time to look at this. I've taken a look at the docker config on the Synology, and when creating the container from an image there is an option to use the same network as the docker host (instead of a bridge).

I've done this and now get

External internet access denied - https://sabnzbd.org/access-denied

When accessing over 5G. Mission accomplished.

Cheers
Post Reply