Server Change Listen IP of WebAdmin (only)

[doctorrock]

Hi.


I'm actually stuck with a problem.

The WebAdmin HTTP server seems to listen on the same IPs as the main game process (mainly, 0.0.0.0 if one doesn't change it)
Not being able to change the web server listen IP (only) is a bad security practice.

I would like the Web Admin HTTP Server to only listen on 127.0.0.1 interface (whatever the port), so that it cant be accessed by external traffic ; but AFAIK , that doesn't seem possible actually.

Are there any plans in the future to improve that ? Or perhaps I missed the option ?

Thx.

 

[®omano]

Deny access from external network from your firewall and/or router?

 

[doctorrock]

Yep , but that's what I consider the "poor" solution. I would have prefered the process to not bind the external IPs but only loopback , so that if I change the machine into the physical network , I don't have to remember about some firewall rules

 

[®omano]

Server is made in general to be used on a dedicated machine for people to use outside of their local network. Local KF server is not the common thing so I guess you'll have to adapt because this is how it works as far as I know.

 

[doctorrock]

mmm yes, but not only localhost.

My machine actually got several external IPs : IP1 , IP2 and IP3.
What if I want the game to run on IP1 , but the webinterface on IP2 ? Having IP2 routed into an internal network not accessible from the Internet ?

Perhaps an improvement for a next version ?
Under Unix, a process can tell which interface it wants to bind, aka on which network and IP it wants to be accessed. Here, we cannot change that (at least for WebServer , which is tied to the game bound IP, itself being changeable).

 

[®omano]

The server is one unique process (game server + web admin + ip download and so on, one process that manages all), this is why you can't.

 

[fredtec]

2doctorrock

You can configure the nginx webserver.
Nginx listens for IP2 and forwards to localhost.

        location /ServerAdmin/ {
                proxy_pass http://127.0.0.1:8080/ServerAdmin/;
        }

        location /images/ {
                proxy_pass http://127.0.0.1:8080/images/;
        }