Howdy!

A friend got me to look at this app, pretty cool for a lightweight program, well done.

I have two problem though; Each of my machines has two i.p. addresses - A private 10.x.x.x address in the same subnet, and a public 202.x.x.x in the same subnet. Locally, they talk to each other over the switch. The Primary machine is also occasionally on VPN, which gives that machine a third i.p. address.

Problem 1:
Multiplicity binds to 'an' i.p. address on startup. However, I can't select the i.p. it chooses. Ideally I would put it on the private ones, as they never change.

It chooses the public ones, but that's not a problem as I have a good firewall. However, if the VPN is up when it starts, it chooses my VPN i.p. as source. My secondary doesn't have a route back to this i.p. address as it's not on the VPN.

Problem 2 is that the Secondary machine doesn't like allowing connections on a public i.p. address, even when it's from the same subnet, and the 'allow same subnet is turned on'. The second option 'allow connections from private i.p. addresses would also stop this, but is turned off. When troubleshooting, the error is that the secondary machine needs "allow from same subnet" turned off.

I imagine it's not something that's tested often, so I figure it's a bug. Technically, the machines are talking to each other from the same subnet, but not from private i.p. addresses:
Example addresses:

202.1.2.1 / 255.255.255.248 - Primary
202.1.2.2 / 255.255.255.248 - Secondary

This is treated as a connected route, and the other machine is in the same subnet as the secondary. But in order to allow connections, I must untick "only allow connections from the same subnet". Testing this is easy; you can set up a LAN on any address you like as long as it's outside private ranges to replicate the problem. Forum admins are welcome to Email me if you have questions.

So, if you want suggestions, here's what you do:
One option: Accept connections on . This is a direct replacement for "allow from this subnet" but is much more specific.

The second option for "only allow from 192.etc" should be replaced with "allow from these subnets" (and list all connected networks as options). This would give you both the ability to lock the thing down to the LAN only, or a single i.p. / range of i.p. addresses on the Internet (assuming you might want to use this across the internet.)

Alternatively, you could just set the thing to listen on a specific interface or existing Dialup / VPN adapter, and not bother with selecting i.p. addresses, or subnets etc. i.e. "I trust everything on my LAN, but not on my dialup or VPN connection etc". Use of a password would still be smart though!

thinkdesk

Locked Post

Search this post