Emby Server IP filtering feature has an issue

[instrumentally 8]

The Emby Server IP filtering feature is broken.  Here's a video that shows this to be the case:  

 

[Luke 42077]

Hi, can you please explain your issue in your own words? We're happy to help. Thanks.

[instrumentally 8]

My own words:  The Remote IP address filter feature on the "Network" page doesn't work at all. The only way that the Emby app on my Android device can access the Emby server is to leave the "Remote IP address filter" field blank/empty.  The video shows this to be the case.

[Luke 42077]

Can you please provide a specific example?

The feature works just fine, but it depends on the server's ability to determine if a connection is remote or that. And that ability will depend on the setup of your network.

So please go over an example while also describing your network layout. Thanks.

[instrumentally 8]

The video shows a specific example.  The IP address of the Android device of shows 107.77.202.114.   Entering this IP address in the "Remote IP address filter" field actually BLOCKS the mobile device from connecting to the server, even when WHITELIST is the chosen option. Entering 107.0.0.0/8 in the RIPAF field likewise BLOCKS the mobile device when it should be doing just the opposite. 

Your statement "but it depends on the server's ability to determine if a connection is remote" doesn't provide any details on how to ensure that the Windows server can do just that.

Edited January 2, 2023 by instrumentally

[jellis413 4]

It has been a while since I tried, but I could not use a /8 and had to do IP addresses individually.  Static IPs, so it wasnt a big deal to me and therefore I didnt spend any real time trying to get it to work, but in your video I wonder if you whitelist the single 107.x.x.114 IP address if it works.  

[instrumentally 8]

I had already tried all the combinations before posting the video and this forum posting:  

107.77.0.0/16

107.0.0.0/8

107.77.202.21

None of them work. They all are blocked despite having them under the "Whitelist" category.

Something is broken with the Emby server code.

[Q-Droid 989]

Was asking about subnet. Already tried.

I think what @Luke was asking is whether there's something about your network that is preventing Emby from knowing your phone's public IP.  It's very common for people to use misconfigured reverse proxies and VPNs that mask or drop these details. They don't share the info when asking for help, then follow-up later with a "nevermind".

Edit: removed subnet suggestion

Edited January 2, 2023 by Q-Droid

[instrumentally 8]

Something is broken with the Emby server code. Badly broken, for if I flip the "Remote IP address filter mode:" from Whitelist to Blacklist, then the server will PERMIT my Android device access to the server.  This is the complete opposite of what should occur.

[instrumentally 8]

9 minutes ago, Q-Droid said:

I think what @Luke was asking is whether there's something about your network that is preventing Emby from knowing your phone's public IP. 

Such as...?

I find Luke's suggestion highly improbable, seeing how the Windows 2016 server that Emby is running on is also running IIS, and hosts several web sites.  If I use my Android device and the Firefox on this device, and turn off WiFi, then visit one of the web pages on one of the sites hosted by this selfsafe server, I will discover, when looking at the IIS logs, that the server properly identifies my Android device's IP address.  See sample below:

2023-01-02 13:49:31 192.168.1.15 GET /faqs.html - 443 - 107.77.202.21 Mozilla/5.0+(Android+12;+Mobile;+rv:95.0)+Gecko/95.0+Firefox/95.0 http://mywebsite.com/ 200 0 0 26

You can plainly see that IIS detects the device's IP address.  Why can't Emby?  Is it because there is a bug in Emby server?

[pwhodges 2012]

How about providing the server log so that Luke can see what the server is seeing and reacting to?

Paul

[instrumentally 8]

Maybe our posts crossed each other, but I already provided a snippet of an IIS log file.

[Q-Droid 989]

More info can only help troubleshoot and identify the problem. If it's a bug only then can it be fixed.

 

[instrumentally 8]

37 minutes ago, Q-Droid said:

More info can only help troubleshoot and identify the problem.

 

I don't know how much more information I can provide.  I've provided log info, a video showing step by step what I am doing, tried alternative filter IPs strings, etc.

[Luke 42077]

1 hour ago, instrumentally said:

Such as...?

I find Luke's suggestion highly improbable, seeing how the Windows 2016 server that Emby is running on is also running IIS, and hosts several web sites.  If I use my Android device and the Firefox on this device, and turn off WiFi, then visit one of the web pages on one of the sites hosted by this selfsafe server, I will discover, when looking at the IIS logs, that the server properly identifies my Android device's IP address.  See sample below:

2023-01-02 13:49:31 192.168.1.15 GET /faqs.html - 443 - 107.77.202.21 Mozilla/5.0+(Android+12;+Mobile;+rv:95.0)+Gecko/95.0+Firefox/95.0 http://mywebsite.com/ 200 0 0 26

You can plainly see that IIS detects the device's IP address.  Why can't Emby?  Is it because there is a bug in Emby server?

What address do you see in the server dashboard now playing section when they play?

[pwhodges 2012]

2 hours ago, instrumentally said:

Maybe our posts crossed each other, but I already provided a snippet of an IIS log file.

How will an IIS log help diagnosing what may be an Emby problem?  Emby generates a log, too.

Paul

[instrumentally 8]

1 hour ago, Luke said:

What address do you see in the server dashboard now playing section when they play?

I see the following IP: 166.170.30.13 

That is not the IP address that the IIS log shows.   Nor is that the IP address that the following webistes return:  showmyip.com,  whatismyip.com, whatismyipaddress.com

[justinrh 260]

4 hours ago, instrumentally said:

I see the following IP: 166.170.30.13

So, I guess you need to figure where that IP is coming from first.

[Happy2Play 9780]

Don't necessarily see why dashboard IP would have any effect on Remote IP Filter as that is for restricting clients.

But yes if Dashboard does not reflect your true public address there are other issues also.

 

[instrumentally 8]

22 minutes ago, justinrh said:

I guess you need to figure where that IP is coming from first.

So it is my duty to figure out why Emby is the only piece of code in the equation that is showing the wrong IP address? I would think that this job would fall to Emby's developer(s).  What more am I supposed to do? 

The only other thing that I can mention is that both IP blocks (107.77.0.0/16 and 166.170.0.0/16) belong to AT&T Mobile, which is indeed my mobile carrier provider.

[justinrh 260]

Just now, instrumentally said:

What more am I supposed to do?

Have you described your network topology between the phone and embyserver.exe?

[Happy2Play 9780]

7 minutes ago, instrumentally said:

So it is my duty to figure out why Emby is the only piece of code in the equation that is showing the wrong IP address? I would think that this job would fall to Emby's developer(s).

But that is what your setup is reporting to Emby.  Are you using a VPN?

[instrumentally 8]

20 minutes ago, Happy2Play said:

Are you using a VPN?

No, I am not using a VPN.

[instrumentally 8]

20 minutes ago, Happy2Play said:

But that is what your setup is reporting to Emby.

But my "setup" is also reporting the "correct" IP address to MS Internet Information Services.   How can IIS detect one IP and Emby a totally different IP, all coming from a single Android mobile device (which has WiFi turned off)?

[pwhodges 2012]

Maybe because there are multiple headers which are not consistent, and the the programs look at them differently.  Of course, the logs from Emby might help diagnose this, unless you prefer to continue this guessing game.

Paul