A Guide To Safe Remote Access of OctoPrint

You'd be surprised at how many things can negatively impact your wifi quality.

  • Neighbors' wifi networks sharing the same channel as yours (or even your own competing routers/hotspots)
  • Metal pipes like radiators, chain-link fence, possibly even lead-based paint on the walls, large metal plates
  • Aquariums or other large volumes of water
  • Foilage (the water in the leaves)
  • Microwave ovens in operation
  • Sparkgaps (like those found in a tesla coil)
2 Likes

Yes but those things impact more on the bandwidth than on the latency in my experience.
But I never tested how much lag you get when you're using 100% of a bad connection.

Thanks for mentioning it :slight_smile:

I happen to have bad wifi atm. I'm not in charge of the internet here, but we're only getting 50Mbps. (very slow)..and there's interference issues on top of that. I ask about latency because I'd like to eventually have a few printer's up and running with 2 HD camera feeds on each machine . So with that in mind, I'm wondering if buying a used router running DD-WRT, set up in repeater mode and with a VPN server on it would get me farther than a Raspberry Pi.

Yeah that would be a way to do it :slight_smile:
Do you want to watch all cam streams at once or just the two of the selected printer?

I'd like to have 1 feed on screen, per printer.

Yeah that should work :slight_smile:

Something that people havent considered is using HAProxy with Certificate based authentication. I realise this isnt for the beginner but there is a few good tutorials for doing this.
Octoprint uses HAProxy by default to forward port 5000 to port 80.

Is this a secure way?
Port forwarding based on ip address on my router or with reverse proxy on ip address?
I have a RPi-4. Can i run octoprint and a reverse proxy on the same hardware or is this not secure?

One thing I haven't seen mentioned yet is Hamachi VPN (which is now owned by LogMeIn). This doesn't require any firewall ports to be opened because it relies on outbound connections only to do all the connection management. You can try it for free with up to 5 devices on a network and they have clients for most operating systems. I've used it for years to manage some remote computers without having to ever open a firewall port. Worth a try, maybe? There's a client that will run on OctoPi but it does require some manual configuration.

3 Likes

I would be interested as well if somebody has made experience with Hamachi so far, becuase i can't port forward my Router (because there is none) i have to use theese alternatives and also had good experiences with hamachi when played with it as a VLAN.
Would like to see if someone has made experience with it and is ready to share it :slight_smile:

Hello, I recently installed octoprint in my raspberri pi and its working perfectly. But my main goal with the raspberry is to can use it from outside of my local network.

I've been these 2 days before trying to port forwarding the ip of my raspberry to can access from the public IP (sorry if I have some mistake with the concepts I'm just starting to learn the basics things about networking). I made a static IP first to my raspberry, and then Port forwarded this IP with the https port (443).

After trying a lot, I tried to search somebody who can help me as for example the developers of my router, so I got in contact with them and they asked me to send them a backup of my settings on the router, so I did it and this was their answer:

''"Unfortunately, the IP address [100.xx.xx.xx] on WAN is the private network IP address.

There will be not possible to reach device connected on LAN from WAN side.

Only thing you can do is to ask Vodafone to provide you with the public IP address for your PPPoE connection."

The thing is that I live in a rented home and the internet of the home is provided by my landlord, so I have no direct contact with the service, and either I don't want to pay a extra cost for this.

So I wonder if somebody of you would have some idea or solution for this thing, is giving me real headheach.

Thanks in advance!

PS. I know port forwarding is not a secure way to do it, but I wanted to install Haproxy also to this port, making octoprint look as unsecure website and then asking you for an user and a password. I don't know if this is good enough to connect safety from outside.

Trying to go the port forwarding route but it won't work for some reason, been at it for three days. So I took a look at Polar Cloud and my don't they want a lot of access to your stuff! They won't let you sign up by just email and want access to every file, every picture, and all your contacts! Really? Why, I must ask, this seems way scarier then port forwarding.

There is now a plugin named Ngrok Tunnel in the plugin repository that creates a secure alternative to port forwarding that is easy to set up. It secures your communication with SSL (HTTPS) and Basic Authentication (username/password), and does not require you to open up your network in any way.

3 Likes

@fieldOfView Also now added to the post :+1:

I recently started using remote.it to access my octopi and home automation r-pi.
It’s free for up to 10 devices and seems to work very well. I found it when I was searching for a way to get into my home network through my Starlink connection. It uses an encrypted P2P connection so I think it’s pretty safe.
Does anybody know of any reasons this would not be a safe option?

I'll post here as well.

I stumbled on this https://www.authelia.com/ and set it up to get a bit more secure.
If I'm going to access my octoprint external I need to use 2 factor login.
I'm running my HAproxy on my router ( pfsense ) so I haven't tried to set it up locally.

Rocking a Swag And Authelia (runing in containers) with 2FA (when connecting outside of my network) i also have GeoLite2 setup . I Also have a Wireguard VPN.

Thinking about adding Cloudflare in the equation.

Hello,
I am sorry to bother you all but I am very new to Information tech like SSH and all that fun stuff. I am curious though. If I only have the octo print instance on my local network, is it accessible to everyone who has my IP address the minute I plug it in? I didn’t enable the SSH option. So I am unsure if is should be worried or not.

No you are absolutely fine. Your IP address you use to access OctoPrint is a private IP that only works while you are connected to your local network. In order for it to be openly accessible on the internet you must take additional steps than just installing OctoPrint.

SSH enables access to the console on the Pi, but still only through the local network only - it's a useful tool for troubleshooting or maintaining the system. Again, unless you have explicitly opened up SSH to the internet (this is not something you can 'accidentally' do), it is not accessible to anyone else.

Thank you I setup useing a reverse proxy and I didn't think about the rate limiting that was useful advice :slight_smile: