SABnzbd blocks Kochab behind a reverse proxy

SABnzbd 5.2 and newer refuse proxied requests unless the proxy is trusted. Add the proxy's IP to xff_trusted_hosts, restart SABnzbd, and Kochab connects again.

SABnzbd worked through your reverse proxy, you updated it, and now Kochab shows this:

SABnzbd blocked this connection as not local. Behind a reverse proxy, turn on verify_xff_header and add the proxy’s IP to xff_trusted_hosts in SABnzbd Config > Special, then restart SABnzbd. Otherwise, raise External internet access to Full API under SABnzbd Config > General, or connect from the local network.

SABnzbd may still work at home on its LAN address. Only requests that pass through the proxy are refused.

Why SABnzbd does this

SABnzbd added this check on purpose, and later updates keep it. A reverse proxy adds an X-Forwarded-For header naming the client it is forwarding for. Before 5.2, SABnzbd accepted that header from any proxy on a local network. Starting with SABnzbd 5.2 (commit c01371a), it accepts the header only from a proxy listed in xff_trusted_hosts, which is empty by default. A forwarded request from any other proxy is treated as external, and SABnzbd answers with 403 “External internet access denied”.

Fix: trust your proxy

  1. In SABnzbd, open Config > Special.
  2. Make sure verify_xff_header is on. It is on by default.
  3. Add your proxy’s IP address to xff_trusted_hosts. This is the address the proxy uses to connect to SABnzbd, not your public IP. If the proxy runs in Docker on the same host, it is usually the proxy container’s address on the Docker network.
  4. Save, then restart SABnzbd. The setting does not take effect until it restarts.
  5. In Kochab, open the SABnzbd service and run the connection test again.

SABnzbd now reads the real client address from the header your proxy sends. Requests from the internet are still treated as external, so your External internet access setting decides what they can do.

Fallback: allow the API from outside

If you cannot pin down the proxy’s address, open Config > General and set External internet access to Full API. Kochab only uses the API, so this is enough. Every API call still needs your API key.

The other option is to reach SABnzbd without the proxy. Use the LAN address at home, or a VPN such as Tailscale away from home, and SABnzbd sees a local connection.

A different SABnzbd message

If Kochab says SABnzbd “did not accept this hostname” instead, that is SABnzbd’s host_whitelist, also under Config > Special. Add the hostname Kochab connects with, or connect by IP address.