# SABnzbd blocks Kochab behind a reverse proxy

SABnzbd 5.2 and newer refuse proxied requests unless the proxy is trusted. Add the proxy's IP to xff_trusted_hosts, restart SABnzbd, and Kochab connects again.

Canonical: https://kochab.io/docs/troubleshooting/sabnzbd-blocked-behind-a-reverse-proxy/

SABnzbd worked through your reverse proxy, you updated it, and now Kochab shows this:

> SABnzbd blocked this connection as not local. Behind a reverse proxy, turn on verify_xff_header
> and add the proxy's IP to xff_trusted_hosts in SABnzbd Config > Special, then restart SABnzbd.
> Otherwise, raise External internet access to Full API under SABnzbd Config > General, or connect
> from the local network.

SABnzbd may still work at home on its LAN address. Only requests that pass through the proxy are
refused.

## Why SABnzbd does this

SABnzbd added this check on purpose, and later updates keep it. A reverse proxy adds an
`X-Forwarded-For` header naming the client it is forwarding for. Before 5.2, SABnzbd accepted that
header from any proxy on a local network. Starting with SABnzbd 5.2
([commit c01371a](https://github.com/sabnzbd/sabnzbd/commit/c01371a6a)), it accepts the header
only from a proxy listed in `xff_trusted_hosts`, which is empty by default. A forwarded request
from any other proxy is treated as external, and SABnzbd answers with 403 "External internet
access denied".

## Fix: trust your proxy

1. In SABnzbd, open **Config > Special**.
2. Make sure **verify_xff_header** is on. It is on by default.
3. Add your proxy's IP address to **xff_trusted_hosts**. This is the address the proxy uses to
   connect to SABnzbd, not your public IP. If the proxy runs in Docker on the same host, it is
   usually the proxy container's address on the Docker network.
4. Save, then restart SABnzbd. The setting does not take effect until it restarts.
5. In Kochab, open the SABnzbd service and run the connection test again.

SABnzbd now reads the real client address from the header your proxy sends. Requests from the
internet are still treated as external, so your External internet access setting decides what
they can do.

## Fallback: allow the API from outside

If you cannot pin down the proxy's address, open **Config > General** and set **External internet
access** to **Full API**. Kochab only uses the API, so this is enough. Every API call still needs
your API key.

The other option is to reach SABnzbd without the proxy. Use the LAN address at home, or a VPN such
as [Tailscale](/docs/remote-access-tailscale/) away from home, and SABnzbd sees a local connection.

## A different SABnzbd message

If Kochab says SABnzbd "did not accept this hostname" instead, that is SABnzbd's **host_whitelist**,
also under **Config > Special**. Add the hostname Kochab connects with, or connect by IP address.

## Related

- [Configure SABnzbd or NZBGet for Sonarr and Radarr](/docs/sabnzbd-nzbget-settings-sonarr-radarr/)
- [Reverse proxies and remote access](/docs/remote-access/)
- [Remote access with nginx or SWAG](/docs/remote-access-nginx-swag/)
- [Why won't Kochab connect to my service?](/docs/troubleshooting/service-wont-connect/)