LAN segment setting problem

[zhangy104 0]

Hello,

I used NPM for network proxy, and the Emby server set the LAN segment, 192.168.3.1/24. Then I set up on the server that the user can log in with a PIN on the local area network and use traffic to access the server. The PIN can still be used. The login address is the NPM address, 172.20.0.1. Is there a problem with my settings? I need can not use PIN to access the external network. Server version 4.6.7.0

[Abobader 3464]

Hello zhangy104,

** This is an auto reply **

Please wait for someone from staff support or our members to reply to you.

It's recommended to provide more info, as it explain in this thread:

Thank you.

Emby Team

[rbjtech 5284]

Add the subnets you want to be treated as 'local' in the emby network section.  Don't assume any RFC1918 address will be local.

ie add - 192.168.3.0/24 and 172.20.0.0/24(?) if you want both of these SUBNETS to be classed as local by emby (ie a Pin will work).  

[zhangy104 0]

15 minutes ago, rbjtech said:

Add the subnets you want to be treated as 'local' in the emby network section. Don't assume any RFC1918 address will be local.

ie add - 192.168.3.0/24 and 172.20.0.0/24(?) if you want both of these SUBNETS to be classed as local by emby (ie a Pin will work).  

I only added 192.168.3.0/24 as the local network segment, and other network segments should all be considered as external network segments. But I see in the login record that the login address is 172.20.0.1, and I can also log in with PIN. So is this a bug? The same setting is no problem in Jellyfin.

Edited November 29, 2021 by zhangy104

[rbjtech 5284]

It sounds like it yes - 172.20.x.y is NOT an RFC1918 (local) address.

RFC1918 = 172.16.0.0 - 172.31.255.255 (172.16/12 prefix)

Edited November 29, 2021 by rbjtech

[zhangy104 0]

@LukeCan you take a test? The server version is synology DSM7.0 X64, 4.6.7.0

[Luke 42081]

It's probably being misinterpreted as rfc1918.

[pwhodges 2012]

57 minutes ago, rbjtech said:

It sounds like it yes - 172.20.x.y is NOT an RFC1918 (local) address.

RFC1918 = 172.16.0.0 - 172.31.255.255 (172.16/12 prefix)

Eh? 172.20 is in the range between 172.16 and 172.31 surely...

Paul

[zhangy104 0]

16 minutes ago, Luke said:

It's probably being misinterpreted as rfc1918.

At the moment it seems to be a bug

[rbjtech 5284]

28 minutes ago, pwhodges said:

Eh? 172.20 is in the range between 172.16 and 172.31 surely...

Paul

doh! - That'll teach me to speed read !

You are correct - 172.20.x.y IS an RFC1918 address, thus it SHOULD be treated as a local address.

Use an address OUTSIDE this range if you want emby to treat it as an external address ..

[Luke 42081]

Sorry I also misread.

@zhangy104 there's no bug here. 172 is being correct treated as a local server address because it is considered private address space.

[zhangy104 0]

3 hours ago, Luke said:

Sorry I also misread.

@zhangy104 there's no bug here. 172 is being correct treated as a local server address because it is considered private address space.

@LukeI don’t think so. It’s described in the network settings "If set, all other IP addresses will be considered to be on the external network and will be subject to the external bandwidth restrictions." I set 192.168.3.0/24 as local Network, but 172.20.0.1 is not in 192.168.3.1-192.168.3.255, I think it has been classified as an external network. Am I wrong? Or are all private addresses treated as a local network?

[zhangy104 0]

There is also a paragraph in the network settings "If left blank, only the server's subnet and common private IP subnets (10.0.0.0/8, 192.168.0.0/24, etc.) are considered to be on the local network."

[Luke 42081]

OK we either need to adjust the help text or rework the option but it looks like currently there's no way to prevent an rfc1918 address from being considered private.

[Carlo 4561]

This has always been a bit of a problem.  What really needs to happen is Emby stop assisting if the user fills in anything. If left blank all of the rfc1918 are treated local.
If the user fills in anything, only what they entered is treated local.

That will fix the local VPN server use, as well as Jail and Docker use with different IP ranges.

This would even fix the issue that pops up a couple times a year when someone has Emby running in the cloud on a public IP address.  It puts the admin in total control of what is and isn't local.

Right now the way this is handled isn't correct as a admin may run a local VPN server running in the reserved address space (proper) but want that range of IPs treated as remote users (logical).

Edited December 10, 2021 by cayars

[zhangy104 0]

OK,the problem was solved. I set the IP of the network proxy to 10.1.1.0. Emby can handle it correctly. And the class B RFC1918 address(172.16.0.0-172.31.255.255) is classified in the local network regardless of any setting.

[Luke 42081]

Thanks for the feedback.