Reverse proxy vs. disallow remote connections

[mobamobamoba 5]

What's the difference between running Emby behind a reverse proxy with (a) "Allow remote connections to this Emby Server" UNchecked versus ( checking "Allow remote connections to this Emby Server" then selecting "Handled by reverse proxy" under Secure Selection Mode? They seem to do the exact same thing - allow only local connections with the proxy handling both remote connections and HTTPS - and was curious if there's a meaningful difference between the two modes or not. Thanks.

 

[Luke 37291]

The difference is that with the handled by proxy, the proxy handles the ssl certificate, whereas if you enable it in emby, you'll have to set emby up with one. 

[mobamobamoba 5]

I'm not sure what you mean - the proxy is handling the SSL cert in both instances. With "allow remote connections" unchecked, the proxy handles both the SSL and remote connections; with "allow remote connections" check and with "handled by reverse proxy" selected... the proxy handles both SSL and remote connections. See what I mean? They seem to do the exact same thing and I'm trying to figure out if there's a difference between them.

[Luke 37291]

You should keep remote connections enabled so that emby server can report it's remote access url to your emby apps.

[mobamobamoba 5]

I see. It was working fine both ways in both Kodi and browser and I couldn't figure out the difference. Thanks for clearing it up.

[darkassassin07 434]

Remote connections are based on the ip address of the client I believe. If the reverse proxy is passing the real ip of the client to the emby server instead of the proxies ip, disallowing remote connections will function as expected preventing connections that are from external ip addresses.

 

Thus is assuming the emby server in on the same lan as the emby server. If they are on separate networks disabling remote connections will prevent any connection from the proxy.

[mobamobamoba 5]

Remote connections are based on the ip address of the client I believe. If the reverse proxy is passing the real ip of the client to the emby server instead of the proxies ip, disallowing remote connections will function as expected preventing connections that are from external ip addresses.

 

Thus is assuming the emby server in on the same lan as the emby server. If they are on separate networks disabling remote connections will prevent any connection from the proxy.

Unchecking "allow remote connections" still allows reverse proxy connections and the IPs in the logs are the remote IPs of whatever is connecting. That's why I asked this question, because I couldn't figure out if there was a difference between unchecking "allow remote connections" and using the reverse proxy option.

 

I was in part asking because, even though I have no Emby ports open in my router since everything external is going through the proxy, I didn't like that allowing remote connections forces an HTTP remote port (you can't leave it blank) and I was trying to button up the security on my system as much as possible.