Limit users outside network to individual IP adress.

[MediaIntelNUC 30]

Hi!

Im thinking of beefing up my security in regards to remote acess.

I have Reverse proxy with Caddy and NO-IP but then i was thinking i could just restrict remote acess to the IP:s of my devices i use outside LAN and a few other users.

I have looked at the knowledge base but couldnt really figure it out and i thought i would ask for some pointers in the server settings first.

Im guessing its the "Filter for external IP-adresses"?

And if so, do i add them like: 192.168.x.x,192.168.x.x ? (an external IP might look different regarding numbers but you get what i mean:))

Is Emby Connect worth looking into?

Is there any settings in the server that anyone would reccomend for restricting remote acess security other than this those would be most welcome

Thanx!

 

N.

 

 

[Neminem 1574]

Does all the user have a static ip?

What if there DHCP lease renews?

What if they go mobile?

Personally I use geo blocking in my firewall.

 

[MediaIntelNUC 30]

Thanx for your reply @Neminem

3 minutes ago, Neminem said:

Does all the user have a static ip?

If not, i will make sure that they have.

5 minutes ago, Neminem said:

What if there DHCP lease renews?

Good question, will look in to it.

6 minutes ago, Neminem said:

What if they go mobile?

Another good one,hadnt thought about that, thanx!

9 minutes ago, Neminem said:

Personally I use geo blocking in my firewall.

I sae that as an option when reading up, do you use it in windows firewall?

Thanx again, you saved me,probably,a lot of time for schooling me on whitelists

[Neminem 1574]

10 minutes ago, MediaIntelNUC said:

do you use it in windows firewall?

No its setup in my Ubiquity Security Router.

[MediaIntelNUC 30]

All right, thanx, will look into it.

[visproduction 320]

Media I,

Security idea that might be useful for users who like using the web client only.

I like setting up a hidden page online on a website I control, with a fun image and an image map.  The user clicks some part of the image and they are taken to the Emby IP address.

Security benefits:

1. You set the IP address and the port, inside some area of the image of some fun photo (image map).  It is less likely to be grabbed by any bot.
   1. https://imageonline.io/image-map-generator/
   2. https://www.image-map.net/
2. Users get a link to the hidden page, where you put any promotions, updates, notices or reviews.
3. If you decide to change the port or have to move to a new IP address, you update the hidden page link and you're done.  You never have to suggest users go to an IP address, which, for many mobile browser is not actually easy or practically impossible to do.

Example code to be added to a page where you are the admin of the site. (It does not work with social media member sites). Replace the 192 address with your remote access address.
 

<a href="http://192.168.1.5:8096"><img src="your-image.jpg" alt="Member only access to the media server" title="Member only access to the media server" usemap="#image-map" height="750" width="500"></a>
<h1>Welcome to Ralph's collection</h1>
<p>Some promotion or review...</p>

<map name="image-map">
  <area shape="rect" coords="405,597,591,1320" href="#" alt="Area 1">
  <area shape="rect" coords="575,609,801,670" href="#" alt="Area 2">
  <area shape="rect" coords="373,726,458,928" href="#" alt="Area 3">
</map>

 

 

Edited 5 hours ago by visproduction

[MediaIntelNUC 30]

@visproduction

Thanx for that!

I got to admit that after reading up on ways to block IP:s, rerouting IP:s, reverse proxys and pages of coding, Your suggestion was by far the most creative and fun!

Its a bit above my paygrade for the moment, but when i get the fundamentals locked down i think i might just take you up on that!

Peace brother! 

N.

 

[Neminem 1574]

@visproductionhow would that work with Emby's apps

[visproduction 320]

Nem,
Android version of Emby goes directly from the App to the saved IP address.  There is no step to go to another website first, so I don't think the apps would work.  You can try to set the app to go to the hidden page link, instead.  I am not sure if it will even show a website page.  This trick is really more for web access users.

Edited 1 hour ago by visproduction