Accessing Slimserver via Squeezebox across internet

[faisalm]

Hi,

Is there a way for my slimserver to be running on a remote network (for example at my girlfriend's house), and my squeezebox to connect to it while it is running at my place? The documentation says the squeezebox will scan the local network when it starts up. However, I'd like to be able to tell it to go to a URL where I've opened up a port for the slimserver to run on at the remote location.

-Faisal

[johnc_22]

Hi,

Is there a way for my slimserver to be running on a remote network (for example at my girlfriend's house), and my squeezebox to connect to it while it is running at my place?
-Faisal

I tested this out at work by opening up the appropriate ports on my firewall at home and forwarding the ports to the computer running slimserver. I used the softsqueeze app to test and it did work but my upstream was not enough for my FLAC files so there was massive delay and dropouts. I'm sure with MP3 files and a solid upstream cable or DSL connection it would work just fine but you certainly want to think about security concerns. I believe you can configure the slimserver to only accept connections from certain IPs.

[azinck3]

Yes, this is possible. It will, however, require some configuration on your part. The simple but unsecure way is to forward ports 3483 and 9000 on your router to the box hosting slimserver.

This, however, leaves your server machine open to potential (but unlikely) exploits. The more secure approach is to use SSH. You'd have to set up SSH on your server machine, but since the squeezebox hardware doesn't support SSH you'd also have to set up an SSH client on your girlfriend's computer, configure it to forward all requests on ports 3483 and 9000 to your remote server computer, then point your SB at her machine.

So the idea is this:

SB -> GF's computer -> your remote server

[azinck3]

I used the softsqueeze app to test and it did work but my upstream was not enough for my FLAC files so there was massive delay and dropouts.

Slimserver will transcode to a user-selectable mp3 bitrate on the fly to avoid this problem.

[mherger]

> However, I'd like to be
> able to tell it to go to a URL where I've opened up a port for the
> slimserver to run on at the remote location.

The SB will scan the local network for easy setup. But you can always
manually define a fixed IP address.

--

Michael

-----------------------------------------------------------
Help translate SlimServer by using the
StringEditor Plugin (http://www.herger.net/slim/)

[johnc_22]

Slimserver will transcode to a user-selectable mp3 bitrate on the fly to avoid this problem.

That is totally cool - doesn't get around my security concerns so I probably won't use that info just yet, but the ability to have my music collection at work (or anywhere I happen to be with my laptop) is just awesome . . . thanks.

[azinck3]

Oh, and this thread reminds me: is there any way for an SB1 to resolve an ip from a domain name? I use my SB1 remotely sometimes but it's a pain for me to look up my IP on a computer--it'd be nice if I could just give it my dynamic dns name directly.

[peter]

On Mon, 1 May 2006 11:44:05 -0700, "azinck3"
<azinck3.2756h01146509102 (AT) no-mx (DOT) forums.slimdevices.com> said:
>
> Yes, this is possible. It will, however, require some configuration on
> your part. The simple but unsecure way is to forward ports 3483 and
> 9000 on your router to the box hosting slimserver.
>
> This, however, leaves your server machine open to potential (but
> unlikely) exploits. The more secure approach is to use SSH. You'd
> have to set up SSH on your server machine, but since the squeezebox
> hardware doesn't support SSH you'd also have to set up an SSH client on
> your girlfriend's computer, configure it to forward all requests on
> ports 3483 and 9000 to your remote server computer, then point your SB
> at her machine.

I've said it before and I'll say it again: Provided he restricts
incoming traffic on your router to his GF's IP address it is totally
unnecessary to use VPN or SSH tunneling for this kind of thing. IP
filters are impenetrable without attackers having cracked his (or her)
ISP first and then it's not just you who's in trouble. Tunneling is
alwyas a hassle and makes everything a lot less reliable. If your
routers support router-to-router LAN tunneling it's worth considering,
but else I'd forget it.

Common sense is requirement #1 in security.

Regards,
Peter

[azinck3]

On Mon, 1 May 2006 11:44:05 -0700, "azinck3"
<azinck3.2756h01146509102 (AT) no-mx (DOT) forums.slimdevices.com> said:
>
> Yes, this is possible. It will, however, require some configuration on
> your part. The simple but unsecure way is to forward ports 3483 and
> 9000 on your router to the box hosting slimserver.
>
> This, however, leaves your server machine open to potential (but
> unlikely) exploits. The more secure approach is to use SSH. You'd
> have to set up SSH on your server machine, but since the squeezebox
> hardware doesn't support SSH you'd also have to set up an SSH client on
> your girlfriend's computer, configure it to forward all requests on
> ports 3483 and 9000 to your remote server computer, then point your SB
> at her machine.

I've said it before and I'll say it again: Provided he restricts
incoming traffic on your router to his GF's IP address it is totally
unnecessary to use VPN or SSH tunneling for this kind of thing. IP
filters are impenetrable without attackers having cracked his (or her)
ISP first and then it's not just you who's in trouble. Tunneling is
alwyas a hassle and makes everything a lot less reliable. If your
routers support router-to-router LAN tunneling it's worth considering,
but else I'd forget it.

Common sense is requirement #1 in security.

Regards,
Peter

I appreciate this feedback and I trust you are correct. Despite being a web programmer in my daily life, I know relatively little about the various attacks that can be mounted so wanted to err on the side of caution in any advice I might give. There seem to be a lot of old-wives tales out there in the network security world, and I have been somewhat baffled by the degrees to which some people will go to "secure" (I use quotes because sometimes the effectiveness of the approach seems questionable) their data. I figure I'm more likely to have my identity stolen by handing my credit card to the waitress at a restaurant than I am by way of having my slimserver hacked. But to each his own.

For me, between not having anything of great value/secrecy on my personal computer and the relative obscurity of slimserver, I've felt no qualms simply using IP filtering. I'm glad to know this is not only convenient, but safe.

[radish]

IP
filters are impenetrable without attackers having cracked his (or her)
ISP first and then it's not just you who's in trouble.

Could you explain this? I've seen you state it a few times in other threads, and I'm not sure I believe it. I'm not a security expert, but I play one on the weekends.

For those who are interested, this page : http://www.securityfocus.com/infocus/1674 gives a nice overview of IP spoofing. Having some form of "control" of any specific ISP or network is certainly not a pre-requisite.

What I would agree with, however, is that IP spoofing is hard, and to be quite honest the risk of someone taking the trouble to attack your slimserver is pretty remote. I'd still use a tunnel though, as I don't find them hard to setup and it's better to be safe than sorry.