Option to list only for connections from localhost (ssh port forwarding use case) #802

New Issue

2026-10-05T04:45:26+02:00

adam commented

2026-10-05 04:45:26 +02:00

Currently there is an option to listen for incoming connections from either an IPv4 address or an IPv6 address or both. It will be great if znc only allows listening on localhost.

One use case for this is exposing this port over SSH to a remote machine using port forwarding and at the same time not letting any IRC client be able to connect to the znc server directly.

Currently there is an option to listen for incoming connections from either an IPv4 address or an IPv6 address or both. It will be great if znc only allows listening on localhost. One use case for this is exposing this port over SSH to a remote machine using port forwarding and at the same time not letting any IRC client be able to connect to the znc server directly.

adam closed this issue

2026-10-05 04:45:26 +02:00

adam commented

2026-10-05 04:45:28 +02:00

Piggybacking on this with an additional idea - the option to connect from local network only, allowing anyone on the same subnet as the server to connect to znc instead of relying on firewall rules to accomplish the same goal.

Piggybacking on this with an additional idea - the option to connect from local network only, allowing anyone on the same subnet as the server to connect to znc instead of relying on firewall rules to accomplish the same goal.

adam commented

2026-10-05 04:45:28 +02:00

After posting this, I was playing around with few options in the Web UI and found BindHost which allows me to specify the addresses to listen on.

In the config file it is present under Listener/Host

After posting this, I was playing around with few options in the Web UI and found `BindHost` which allows me to specify the addresses to listen on. In the config file it is present under `Listener/Host`

adam commented

2026-10-05 04:45:29 +02:00

In user settings, under Authentication, there is an Allowed IPs field:

Leave empty to allow connections from all IPs.
Otherwise, one entry per line, wildcards * and ? are available.

Setting the listener BindHost allows listening on localhost only, as @Tuxdude posted. In fact, my own instance only listens for webadmin connections on localhost, because it's behind an nginx reverse proxy.

In user settings, under **Authentication**, there is an **Allowed IPs** field: > _Leave empty to allow connections from all IPs. Otherwise, one entry per line, wildcards * and ? are available._ Setting the listener **BindHost** allows listening on localhost only, as @Tuxdude posted. In fact, my own instance only listens for webadmin connections on localhost, because it's behind an nginx reverse proxy.

adam commented

2026-10-05 04:45:30 +02:00

Also listeners configuration is available in /msg *status AddPort, not only in webadmin.

Also listeners configuration is available in `/msg *status AddPort`, not only in webadmin.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#802