Emby stops responding to https every couple days

[Crestj 67]

My Virgin Media SuperHub 2 is in modem mode so nothing to configure there.

 

I believe the Google Wifi has no settings for firewall and DDOS settings.

 

No way I'm turning the firewall off on my server!

[Happy2Play 8282]

My Virgin Media SuperHub 2 is in modem mode so nothing to configure there.

 

I believe the Google Wifi has no settings for firewall and DDOS settings.

 

No way I'm turning the firewall off on my server!

 

Might be worth looking at.

Google Wifi has several built-in security measures to protect you and your online world.
Firewall
Google Wifi’s firewall creates a barrier between your Wi-Fi network and the Internet, protecting your data from unsolicited connections or connection attempts. It’s a stateful firewall, which keeps track of connections (TCP streams, UDP communication) traveling across it. Only data associated with a known active connection is allowed through the firewall.

Guess that doesn't apply

Note: Settings like UPnP and port forwarding allow devices to bypass the firewall and have an open connection, leaving them potentially vulnerable.

 

Edited May 4, 2018 by Happy2Play

[Crestj 67]

Well the only change has been Emby updates. At some point in the past I've just lost access externally to my server through the Android Emby app. It's not even intermittent as others are reporting, just no access at all!

 

Weirdly I can still access the server through the web app using the external IP.

 

Maybe it's just the Android App?

[Happy2Play 8282]

Well the only change has been Emby updates. At some point in the past I've just lost access externally to my server through the Android Emby app. It's not even intermittent as others are reporting, just no access at all!

 

Weirdly I can still access the server through the web app using the external IP.

 

Maybe it's just the Android App?

 

If other clients work then I would be troubleshooting in that apps forum.

[mirkonline 0]

Does anybody checked if the problem can be reproduced after disabled the DDOS protection or the entire Firewall?

[extensive 20]

Does anybody checked if the problem can be reproduced after disabled the DDOS protection or the entire Firewall?

i disabled it last night.  i recreated the scenario from yesterday that made it crash and it is still up.  that's not conclusive as i never checked if i could regularly make it crash with that scenario but it is good news.

 

just so we are clear, this is not the solution, just more information for the devs.  i have had this same router/config the whole time.  like you said, it was introduced with an emby upgrade.

[extensive 20]

nevermind, it just crashed.

 

i actually just installed plex yesterday too, it is accessible. 

[mirkonline 0]

nevermind, it just crashed.

 

i actually just installed plex yesterday too, it is accessible. 

 

So, in my case, if I recreate the scenario that I said yesterday.....with DDOS protection enabled I got the problem, without DDOS everything running smooth...

But there could be many causes that make Emby unavailable from internet....

I hope for my case that the DDOS is the only case...otherwise I will have to moving on Plex...

[Jdiesel 1114]

Unless there are multiple reasons that causes https to stop responding I don't believe it is related to DDOS or any router setting for that matter. In my experience it was happening with my server connection directing to the internet with UWF running as my firewall.

 

I would start looking at what type of clients are being used and how they are connecting/disconnecting to the server. I had a mix of Roku, Chromecast, Web, and Android TV clients.

 

Or you can do what I and many others have down, setup a reverse proxy using nginx or apache to handle the SSL connections so all connections to Emby are done on the local machine through http. I have not had https stop responding since I switched over to a nginx reverse proxy a few weeks ago.

[extensive 20]

Or you can do what I and many others have down, setup a reverse proxy using nginx or apache to handle the SSL connections so all connections to Emby are done on the local machine through http. I have not had https stop responding since I switched over to a nginx reverse proxy a few weeks ago.

 

is there a good set of instructions for this?  at this point it is either that or plex.  i would rather stick with emby

[fuzzthekingoftrees 10]

I also have this issue and I can confirm it is not fixed since the update to 3.4.0.0

It has nothing to do with the router firewall, connections are rejected if I try and connect internally or externally

C:\>netstat -an | find "8920" | find "CLOSE_WAIT" /c
78

78 connections at CLOSE_WAIT

$ openssl s_client -connect localhost:8920
connect: Connection refused
connect:errno=111

from the localhost we get a connection refused

$ openssl s_client -connect 192.168.69.124:8920
connect: Connection refused
connect:errno=111

from another client on the LAN we also get a connection refused

 

Shutdown Emby and as expected

C:\>netstat -ano | find "8920" /c
0

Start emby again

C:\>netstat -ano | find "8920" /c
2

And the 8920 port starts working.

I can't see any errors related to this in the emby log and throughout the non working period emby is running perfectly on the 8096 port.

 

I'm going to set up a port monitor to keep an eye on the server so I can get an exact time when it stops working.

 

 

[extensive 20]

luke can you please confirm that you know this is still happening and you received my logs?  thanks.

[Luke 37066]

Yes I am looking into your log files. thanks.

[extensive 20]

Yes I am looking into your log files. thanks.

let me know if you need more, ive turned off ssl but im sure if i turn it back on i could recreate it rather easily.  it crashed a bunch of times when i was listening to an audiobook.  so it wasnt even video...so maybe it has something to do with that?

[AgileHumor 123]

Wow, I thought this was just my system.  So happy that others have this weird issue as I've been concenred about the work to prove it's a bug. 

 

When the issue happens, I've also had ONLY HTTPS stop working (for internal/external users).  Internally, I can access it fine over HTTP.   This has been going on for a couple months after about a year of stability on the stable build. 

 

Restarting Emby via tray icon fixes the problem instantly...and lasts a few days. Log shows no errors, just an HTTP process attempt (will get exact log later).

 

I can confirm this happened once (as it happens every few days) on 3.4 since I updated.   I'm upgrading 3.4.1 today.

 

PS - I installed PRTG (free for 100 or less sensors) last night to monitor the HTTPS port and restart Emby after 2 minutes of not content with "Emby" in the HTML.

PSS - This exact problem happened on my Windows 8.1, and then I rebuilt server to Windows Server 2016 last month...same issue. 

[CorpusColossus 10]

I ended up needing to configure an nginx server because my machine hosting Emby is also hosting other services. I let nginx serve up the SSL certificates and these intermittent HTTPS problems (unsurprisingly to some) went away. Just wanted to remind folks that this is an option and possible workaround, though hopefully a solution can be found and logs can continue to flow to help debug.

 

This thread has some Emby-specific details for configuring nginx:

https://emby.media/community/index.php?/topic/48236-setting-up-emby-behind-a-reverse-proxy-nginx/

[extensive 20]

i fear all of the people jumping on the nginx band wagon has lessened the pressure on the devs to actually fix this.

 

i too have multiple things being hosted on this server so it actually probably would benefit me to implement nginx, just haven't had the time.

[AgileHumor 123]

i fear all of the people jumping on the nginx band wagon has lessened the pressure on the devs to actually fix this.

 

i too have multiple things being hosted on this server so it actually probably would benefit me to implement nginx, just haven't had the time.

I'm not a 100% sure it's an Emby issue.  It could be an issue with .Net/SChannel components of Windows.

 

To test this theory, I've disabled TLS 1.0 and SSL 3.0..and enabled TLS 1.1 and 1.2 as there may be random scans targeting these vulnerabilities that hang SCHANNEL.   I used the gui tool also here https://www.nartac.com/Products/IISCrypto ...but you could also set the registry settings manually (https://4sysops.com/archives/disable-ssl-in-windows-server-2016-with-powershell/).   I've rebooted a few times in the last couple days...so couldn't give a solid week of no restarts.  So far, the issue has not occurred in 5 days since setting. 

 

One question @@extensive, are you getting an SChannel error in your WIndows System event log on or about when this happens?

 

This is all speculation and nothing proved at the moment that this resolves anything. 

[Luke 37066]

i fear all of the people jumping on the nginx band wagon has lessened the pressure on the devs to actually fix this.

 

No, we are still actively looking into this. Thanks.

[fuzzthekingoftrees 10]

To test this theory, I've disabled TLS 1.0 and SSL 3.0..and enabled TLS 1.1 and 1.2

 

Interesting, I have also disabled these protocols (I went all out and disabled 1.1 as well) and my server has also been stable since then. However like you I'm not going to call it fixed as I have restarted a couple of times since then and there hasn't been that much activity externally on my server.

[Crestj 67]

Just added HTTPS for Emby on my server and am seeing this issue also.

 

I've set my Schannel / cipher suites as shown below and (as others have found) it worked for a bit then failed this morning.

 

[Luke 37066]

If anyone is available to jump on the beta server that would be helpful. Thanks.

[Fratopolis 62]

This was happening to me as well. For the life of me I cannot remember what I did but it stopped.

 

I thought I just turned off UPNP. Not sure why it was turned on since I set it manually, or why it would matter for that aspect. But worth a try. Like I said not sure if this was what did it or not as I resolved my issue weeks ago and cannot truely remember what did it.

Edited May 12, 2018 by Fratopolis

[QDivision 39]

I have had the same problem in this thread but my UPNP has always been off so I don't think that's the problem.

[vaise 304]

I have not had this issue yet been in use for a few weeks.  Upnp is off on my system. https letsencrypt is done on my router, rather than the emby server. Dunno why I dont get this issue.