IMPORTANT: Stop forwarding your LMS ports to the internet!

[PasTim]

@Tim:
The "clever" People are the People that causes Michael to open this Thread and thinks about a "solution" or minimize the worst case szenario.

AFAIK Michael wants a solution that the settings from LMS (even when the LMS Server IP & Ports are forwarded to the Internet) are "safer" then now.

Your idea (completly disable the access except for "known" IPs) sounds clever and might be a better solution, but (the people we are talking about) would redo these changes (if MIcheal would add them in a next Version) cause that would stopp these people to access their LMS from allover the World.

Since setting up a VPN isnt that easy/simple and we're dealing with lots of different devices and usecases..

OK - thanks.
Never having set up a VPN I think that for solo usage like mine, SSH using public keys seems to be the simplest solution that should be reasonably secure.

[ian_heys]

Am I safe?

I have been using my Synology NAS, which sits behind my cable TV router, as a VPN Server for connections to my LAN from remote locations.

The only use I have for this is for using LMS/Player combinations, usually but not exclusively on my Android Phone, on the rare occasions that I am away from home.

The only port that is open on my router is that which is required by the Synology NAS VPN plugin and this port is forwarded by my cable TV router.

I have been following, but not fully understanding this thread, for quite a while and thought I'd better ask the question.

I'm not sure I'm up to setting up and understanding all the logging that is needed to examine this issue and it wouldn't be too much of a wrench for me to simply stop doing this as I must admit my use is rather more experimental than useful.

My only significant discovery has been that my free hospital wifi blocks the Synology VPN port and I have to revert to a 4G phone connection which can be expensive if used for any significant time.

[mherger]

IMPORTANT: Stop forwarding your LMS ports to theinternet!

> I have been following, but not fully understanding this thread, for
> quite a while and thought I'd better ask the question.

I think if you're using VPN to access your LMS at home, then you're on
the safe side. Nothing to log or investigate.

--

Michael

[ian_heys]

>
I think if you're using VPN to access your LMS at home, then you're on
the safe side. Nothing to log or investigate.

--

Michael

Thanks Michael.

[Pommes]

Open VPN only seen as cellular

Hi,
after opening the ports today I found this thread.
Now I set up OpenVPN and it works fine, only one issue:
In iPeng I set the Audio Bitrate for cellular to 192kbit and for WiFi to unlimited .
Unfortunately this doesn’t work with open vpn. All music is transcoded to 192 when connected to OpenVPN.
When using port forwarding instead it works fine, untranscoded flac when connected to WiFi, transcoded to 192 when cellular.
Does Anybody have a hint for me?
Thanks
Pommes

[epoch1970]

Open VPN only seen as cellular

Even when connected via wifi to a hostspot?
(or with an alternate ovpn config that specifies the "remote" address as the router OVPN server LAN address, eg 192.168.1.1 instead of 77.16.32.250)

If from within your own (wifi) LAN the iPhone can't reach the public address of your OVPN gateway (due to the 'hairpin' routing problem), I suspect it would send that traffic to cellular which is an external network.

[Pommes]

Even when connected via wifi to a hostspot?
(or with an alternate ovpn config that specifies the "remote" address as the router OVPN server LAN address, eg 192.168.1.1 instead of 77.16.32.250)

If from within your own (wifi) LAN the iPhone can't reach the public address of your OVPN gateway (due to the 'hairpin' routing problem), I suspect it would send that traffic to cellular which is an external network.

I tested again:
When I connect my iPhone from remote to my LMS at home via openvpn, it connects as cellular, both on WiFi and 4g/lte
When I connect my iPhone from remote to my LMS at home via public ip/ open ports, it connects as WiFi, both on WiFi and 4g/lte
That’s both fine with me, I just thought that iPeng would check the connection on my phone.
But:
When connecting via openvpn, all my iPads,Mac, iPhones work well, but my old windows7 squeezeplay laptop buffers every few seconds.
When connecting via public ip/ open ports the windows squeezeplay works fine, as all other devices.

So I would rather keep connecting via public ip/ open ports.
I have put a user/password into LMS, so do you really think it’s a huge security problem with the open ports???
Pease let me know what you honestly think of the security risks.
Thanks
Pommes

[mherger]

I have put a user/password into LMS, so do you really think it’s a huge security problem with the open ports???
Pease let me know what you honestly think of the security risks.

There's no known, major issue yet. But LMS has not been developed with security in mind. A lot has been added to lower the risks. But I wouldn't be surprised if there were major issues we don't know yet.

[Pommes]

There's no known, major issue yet. But LMS has not been developed with security in mind. A lot has been added to lower the risks. But I wouldn't be surprised if there were major issues we don't know yet.

Thank you Michael,
I think I will leave the ports open for now. It is just working much better than with OpenVPN and more convenient.
The server is actually only serving audio and video files. The audio gets backuped every week, I don’t care about loosing the video.
Pommes

[epoch1970]

(I don't understand your connection test report. Anyways.)

When connecting via openvpn, all my iPads,Mac, iPhones work well, but my old windows7 squeezeplay laptop buffers every few seconds.

Are you using an UDP tunnel or a TCP tunnel for OpenVPN? I would think UDP works much better.
There seems to be a Win7-specific OVPN issue with network buffer sizes: https://community.openvpn.net/openvpn/ticket/640
According to bug report, setting this in the Win7 client config file:

sndbuf 131072
rcvbuf 131072

or having this in the corresponding ccd on the server side:

push "sndbuf 131072"
push "rcvbuf 131072"

could solve the issue you see with Win7.

[Pommes]

(I don't understand your connection test report. Anyways.)

Are you using an UDP tunnel or a TCP tunnel for OpenVPN? I would think UDP works much better.
There seems to be a Win7-specific OVPN issue with network buffer sizes: https://community.openvpn.net/openvpn/ticket/640
According to bug report, setting this in the Win7 client config file:

sndbuf 131072
rcvbuf 131072

or having this in the corresponding ccd on the server side:

push "sndbuf 131072"
push "rcvbuf 131072"

could solve the issue you see with Win7.

Sorry but I don’t understand that .
I am just a user with no programming nor Linux skills.
My router runs the OpenVPN server and I just imported the ovpn file into open vpn GUI on windows 7.
The tunnel is udp and runs fine on Mac, iPad and iPhone

[epoch1970]

In other words, try to add

sndbuf 131072
rcvbuf 131072

in the OpenVPN configuration file of the Win7 machine and see if squeezelite works better.

[d6jg]

I tested again:
When I connect my iPhone from remote to my LMS at home via openvpn, it connects as cellular, both on WiFi and 4g/lte
When I connect my iPhone from remote to my LMS at home via public ip/ open ports, it connects as WiFi, both on WiFi and 4g/lte
That’s both fine with me, I just thought that iPeng would check the connection on my phone.
But:
When connecting via openvpn, all my iPads,Mac, iPhones work well, but my old windows7 squeezeplay laptop buffers every few seconds.
When connecting via public ip/ open ports the windows squeezeplay works fine, as all other devices.

So I would rather keep connecting via public ip/ open ports.
I have put a user/password into LMS, so do you really think it’s a huge security problem with the open ports???
Pease let me know what you honestly think of the security risks.
Thanks
Pommes

Open ports are dangerous. If you can see them externally then so will others (and they will look).
You will need to ask Pippin about why iPeng sees the openvpn connection as cellular and not wifi when it is wifi but it could be to do with the outgoing public IP that is detected i.e. if it isn't public then perhaps iPeng assumes it to be cellular. I use an SSL VPN connection on my iPhone and that seems to work correctly.

[Pommes]

In other words, try to add

sndbuf 131072
rcvbuf 131072

in the OpenVPN configuration file of the Win7 machine and see if squeezelite works better.

I edited my ovpn file on windows, squeezeplay still not able to play flac without buffering every few seconds.
I stream from my satelite reciever via openvpn, and this does work a lot better after i edited the ovpn file the way you asked, so thanks for that.
But for streaming flac with squeezeplay i will use the open ports.

[epoch1970]

I edited my ovpn file on windows, squeezeplay still not able to play flac without buffering every few seconds.

Mhh. FLAC or WAV take a lot of bandwidth, probably the tunnel can't keep up.
I have used bridged OpenVPN tunnels from time to time, everything is fine for mp3/AAC/near CD-quality stuff but for hi-def or lossless I've seen issues.
The server side uses its upload link to send the data, with asymmetric connexions (small upload/large download bandwidths) you get a bottleneck there.

You can try adding

fast-io
passtos
comp-lzo no

to your configs (all clients and server). It might help but probably not. The first 2 options are related to network QoS and are not portable, your linux server will probably be happy to comply but the Win machine I don't know. Use the subset that works on both sides.
NOTE: If an option is not supported the OpenVPN process may fail. Don't change these options over the tunnel...
The last option says to disable compression. You're sending binary data, there is nothing to compress there, so by default OpenVPN will just spend a bit of time trying to compress data before changing its mind. Just disable it.
(In openvpn 2.4 there is a new "compress <algo>" option. The way to say "compress no" is to remove/comment the option.)