Domoticz Community Forum - Support & Discussion

I still have a problem with the change in behavior when using a reverse proxy (before the update to 2026.3 all worked well). My trusted networks are set to 192.168.1.*. Synogogy server (proxy) and domoticz RPI are running in the local network.

I have the reverse proxy configuration as defined in https://wiki.domoticz.com/WebServer_Proxy#Synology_NAS.

Before the upgrade, all traffic coming through the reverse proxy was recognised as "untrusted" (as it should be - asking for a login). After the upgrade, all traffic through the proxy is recoginised as "trusted" (so no login anymore).

A test I did: when I put my mobile in 5G only (so no local network - I checked the IP of my mobile and it has 100.x.x.x) and I connect through the proxy, I see in the log Status: [web:443] Incoming connection from: 192.168.1.67, 192.168.1.67 the local IP of my synology... This means that te external IP addres of my mobile (100.x.x.x) is not read by domoticz.

Am I doing something fundamentally wrong? Of has something changed in reading the custom headers information?
Following the settings defined in https://wiki.domoticz.com/WebServer_Proxy#Synology_NAS, the source address should be transferred in the custom headers... Unfortunately I don't know the order in which domoticz takes the custom headers to define the IP address used...

This looks like a known 2026.3 regression rather than your Synology config: in that release Domoticz ignored the forwarded client header, so every request through your proxy appeared to come from the proxy's LAN address - and 192.168.1.67 sits inside your trusted networks, hence no login prompt. It was fixed right after (Domoticz GitHub PR 6937), and the current stable 2026.4 (released October 1) also makes the header selectable: under Settings > Security you can now choose which reverse proxy header the client address is read from (None, X-Forwarded-For, X-Real-IP or Forwarded), per the 2026.4 History.txt entry. So the fix is: update to 2026.4 and set that option to X-Forwarded-For, matching the custom header your Synology sends. After that, external connections through the proxy should show their real IP again and be treated as untrusted.