Message In SABnzbd: Refused connection from: 10.173.1.186 [UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13]

[chuckmehle]

Just below the queue section of SAB, I have started to get this message which I have never seen before.

Refused connection from: 10.173.1.186 [UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13]

It comes in three times every minute.

Any idea on what is going on here?

My SABnzbd is on a Synology NAS under a docker container and is version 3.3.0

I have restarted several times but the message continues to come in.

[sander]

Ah ... interesting ...

What setting do you have at http://127.0.0.1:8080/config/general/#inet_exposure (change ip to ip of your Synology) ?

[chuckmehle]

That URL doesn't get me anywhere... my synology DS 1019+ is at 192.168.1.XX.

Not exactly what I should check based on your note. Could you explain a tad more what I should check?

Thanks in advance

[sander]

what is the SAB url on your synology?

[chuckmehle]

http://192.168.1.14:8080/

[sander]

OK, then what does http://192.168.1.14:8080/config/general/#inet_exposure say?

[chuckmehle]

"No access" for external access

The SABnzbd Host is listed as 0.0.0.0.

As a side note, I have a sonos constellation in house

Thanks for helping on this.

[sander]

"No access" for external access

What if you change it to "Full Web interface" or "Full Web interface - Only external access requires login" ... ?

If that does not work: Config -> Special -> local ranges ... is there anything filled out?

Even it that works: come back, because I then have additional questions for you.

[chuckmehle]

Ok so I changed it to Full Web Interface and the messages seemed to stop.

I then changed to Full Web Interface -- Only External Access Requires Login (and created a Username and PW) and it too seems to have gotten rid of the messages.

I am not sure of the implications of those changes security-wise, but I only access my SAB from inside my LAN (192.168.XX.XXX)

Thanks for the continuing help! What do you think I should check next or set it to?

[sander]

OK, nice that it works ... but I don't understand it either:

10.173.1.186 is a LAN address, and considered as LAN address:

>>> from sabnzbd import misc
>>> misc.is_lan_addr('10.173.1.186')
True

... so it should be accepted. Why does SAB refuse it?


OH WAIT: you did not answer my question: "Config -> Special -> local ranges ... is there anything filled out?"?

Furthermore: if your LAN is 192.168.XX.XXX ... how can there be a 10.x.x. address? Can you describe your LAN / systems / VMs ... ?


FWIW: I googled "[UPnP/1.0 DLNADOC/1.50 Platinum/1.0.5.13]", and it's probably from https://github.com/plutinosoft/Platinum

[chuckmehle]

My Lan is pretty basic... no subnets or VMs.

Base IP is 192.168.1.XXX. Router is a Netgear Orbi AX providing wireless. Also have a netgear unmanaged switch for hardwired devices.

Of the equipment on the LAN, I think the only two "interesting" things are

1. A fairly large SONOS constellation of speakers operating in SONOS NET mode. I can see on the router that each device under SONOS has a 192.168.1.XX IP address
2. Two Nvidia Shield devices... also with 192.168.1.XX IP addresses.

I do have a few TVs that are wireless attached (also 192 addresses).

I only noticed this message behavior as of recently -- which has now stopped since changing from "NO ACCESS" to "FULL WEB ACCESS"

Interestingly enough, I changed it back 'to NO ACCESS and the messages started coming in again. The second I changed it back to FULL WEB INTERFACE the messages stopped again.

Bottom line, I have no known 10.x.x.x network.

Update: I think I found the culprit.

In my Synology NAS, I use EXPRESS VPN as the network interface (in a bonded connection).

I just disabled the VPN and the messages immediately stopped. (with the NO ACCESS setting)

I then reenabled the VPN and interestingly enough, the messages did not start up again. (with the NO ACCESS setting)

I will continue to watch that to see if anything changes again but this seems to have resolved it.

Does that make sense to you?

[sander]

That explains how there can be a different subnet.

It does not explain (at least: not to me) why SAB did not accept that 10.x.x.x which is just a private address.

The good news: it works for you now. Well done.

[chuckmehle]

Thank you very much for your support and attention during this. Really appreciate it.

[zoggy]

That explains how there can be a different subnet.

It does not explain (at least: not to me) why SAB did not accept that 10.x.x.x which is just a private address.

The good news: it works for you now. Well done.

per saf this is by design.. as the validator now processes all requests (not just ui) so now they have to past host check and local range check. which is why you have to either use ip address (which is whitelisted by local range) or add host to whitelist

[chuckmehle]

So those messages started coming back again... Is there a place I can add that IP range into a whitelist?