From 3b514f82f21bddf9b6f7cc0de88bed103f4bae5a Mon Sep 17 00:00:00 2001 From: miniduikboot Date: Wed, 10 Jan 2024 19:06:15 +0100 Subject: [PATCH] Change default ListenIp of Http server to 0.0.0.0 We see that a lot of support tickets are caused by this default setting, as it is one of the things that blocks connections to the server with no obvious indication that this is happening. To make it easier for first time users to set up Impostor, it is important that this setting is changed. Previously we also recommended against direct exposing due to security reasons, but I believe this fear to be unfounded: Microsoft claims that the Kestrel server is hardened against web server vulnerabilities and supports its use both with and without a reverse proxy.[1] We still recommend using reverse proxies if HTTPS support is needed, so that section of documentation still remains. Setting the ListenIp to 127.0.0.1 is still recommended when using a reverse proxy to remove the ability for people to connect directly, so we add it there as a recommendation. [1]: https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel/when-to-use-a-reverse-proxy?view=aspnetcore-8.0 --- Dockerfile | 2 -- docs/Http-server.md | 6 ++++-- docs/Running-the-server.md | 4 ++-- docs/Server-configuration.md | 10 +++++----- src/Impostor.Api/Config/HttpServerConfig.cs | 4 ++-- src/Impostor.Server/config-full.json | 2 +- src/Impostor.Server/config.json | 2 +- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/Dockerfile b/Dockerfile index 9792a1a..8fb50d9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -40,8 +40,6 @@ FROM --platform=$TARGETPLATFORM mcr.microsoft.com/dotnet/aspnet:7.0 WORKDIR /app COPY --from=build /app ./ -# Make the HttpServer listen to 0.0.0.0 to expose it to the outside world. -ENV IMPOSTOR_HttpServer__ListenIp=0.0.0.0 # Override ASPNETCORE_URLS to stop warning. ENV ASPNETCORE_URLS= diff --git a/docs/Http-server.md b/docs/Http-server.md index f74eeff..fd54685 100644 --- a/docs/Http-server.md +++ b/docs/Http-server.md @@ -4,8 +4,8 @@ Since Impostor 1.9.0 a HTTP service is included for matchmaking. Recent versions Depending on whether you want to support mobile players, you can set up the HTTP server in one of two ways: -- Directly expose the HTTP server. Simpler, but only works if you don't want to support mobile players -- Use a reverse proxy to expose the HTTP safer. More complex, but allows mobile players to connect +- Directly expose the HTTP server. Simpler, but only works if you don't want to support mobile players. +- Use a reverse proxy to expose the HTTP server. More complex, but allows mobile players to connect. ## Directly expose the HTTP server. @@ -17,6 +17,8 @@ A reverse proxy allows you to forward HTTP requests from users to multiple servi If you have never set up a reverse proxy before, we recommend you to set up [Caddy](https://caddyserver.com/). It is easy to set up and comes with support for requesting SSL certificates out of the box. +To prevent people from connecting directly to Impostor, we recommend changing the "ListenIp" in the "HttpServer" section to "127.0.0.1". This makes sure people can't connect to your HTTP server other than via your reverse proxy. Keep the "ListenIp" in the "Server" section at "0.0.0.0" though, running the normal game traffic through a proxy is not supported. + ### Caddy To install Caddy, follow the [official installation guide](https://caddyserver.com/docs/install). Then use the following lines as your `Caddyfile` configuration file: diff --git a/docs/Running-the-server.md b/docs/Running-the-server.md index 4443dd3..9bc8f77 100644 --- a/docs/Running-the-server.md +++ b/docs/Running-the-server.md @@ -34,7 +34,7 @@ Docker is a program that allows you to run programs like Impostor in a container After installing Docker, you can just start a Docker container with `docker run`: ``` -docker run -p 127.0.0.1:22023:22023/tcp -p 22023:22023/udp -e IMPOSTOR_Server__PublicIp=your.public.ip.here aeonlucid/impostor:nightly +docker run -p 22023:22023/tcp -p 22023:22023/udp -e IMPOSTOR_Server__PublicIp=your.public.ip.here aeonlucid/impostor:nightly ``` Please replace `your.public.ip.here` with the public IP address of your server. This is the address Among Us will try to reach your server at. @@ -53,7 +53,7 @@ services: image: aeonlucid/impostor:nightly container_name: impostor ports: - - 127.0.0.1:22023:22023/tcp # Remove "127.0.0.1:" if you want to expose Impostor's HTTP server directly to the internet + - 22023:22023/tcp # Add "127.0.0.1:" if you're using a reverse proxy to terminate HTTPS - 22023:22023/udp environment: # Either configure Impostor using environment variables or mount a copy of config.json - IMPOSTOR_Server__PublicIp=your.public.ip.here diff --git a/docs/Server-configuration.md b/docs/Server-configuration.md index 0c33d13..21bee10 100644 --- a/docs/Server-configuration.md +++ b/docs/Server-configuration.md @@ -17,11 +17,11 @@ Some information about all the possible configurations. Click [here](https://git Impostor has an Http Server that is used by recent versions of Among Us to connect to. See [the Http Server page](Http-server.md) for more details on how to set this up. -| Key | Default | Description | -|----------------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Enabled** | `true` | Whether the http server should be enabled. | -| **ListenIp** | `127.0.0.1` | The network interface to listen on. Use `127.0.0.1` if you use a reverse proxy or just run locally. Use `0.0.0.0` if you are directly exposing this server to the internet (not recommended) | -| **ListenPort** | `22023` | The listen port of this server. For port forwarding purposes, this is an TCP port. | +| Key | Default | Description | +|----------------|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **Enabled** | `true` | Whether the http server should be enabled. | +| **ListenIp** | `0.0.0.0` | The network interface to listen on. Use `127.0.0.1` if you use a reverse proxy or just run locally. Use `0.0.0.0` if you are directly exposing this server to the internet | +| **ListenPort** | `22023` | The listen port of this server. For port forwarding purposes, this is an TCP port. | ### AntiCheat diff --git a/src/Impostor.Api/Config/HttpServerConfig.cs b/src/Impostor.Api/Config/HttpServerConfig.cs index fd3cda2..bf7354d 100644 --- a/src/Impostor.Api/Config/HttpServerConfig.cs +++ b/src/Impostor.Api/Config/HttpServerConfig.cs @@ -16,8 +16,8 @@ public class HttpServerConfig /// Gets or sets the IP address the HTTP Matchmaking server will listen on. /// /// Use "127.0.0.1" if you are running behind a reverse proxy or just testing locally. - /// Use "0.0.0.0" if you are directly exposing this server to the internet (not recommended). - public string ListenIp { get; set; } = "127.0.0.1"; + /// Use "0.0.0.0" if you are directly exposing this server to the internet. + public string ListenIp { get; set; } = "0.0.0.0"; /// /// Gets or sets the port the HTTP Matchmaking server will listen on. diff --git a/src/Impostor.Server/config-full.json b/src/Impostor.Server/config-full.json index 9ffb353..83625b1 100644 --- a/src/Impostor.Server/config-full.json +++ b/src/Impostor.Server/config-full.json @@ -7,7 +7,7 @@ }, "HttpServer": { "Enabled": true, - "ListenIp": "127.0.0.1", + "ListenIp": "0.0.0.0", "ListenPort": 22023 }, "AntiCheat": { diff --git a/src/Impostor.Server/config.json b/src/Impostor.Server/config.json index fbad991..a26a7b1 100644 --- a/src/Impostor.Server/config.json +++ b/src/Impostor.Server/config.json @@ -7,7 +7,7 @@ }, "HttpServer": { "Enabled": true, - "ListenIp": "127.0.0.1", + "ListenIp": "0.0.0.0", "ListenPort": 22023 }, "AntiCheat": { -- 2.39.5