Networking & remote access

Local address versus another device#

The default gateway is http://127.0.0.1:3615. Both 127.0.0.1 and localhost refer to the device making the request. They are valid on the server Mac; using them on a phone does not reach that Mac.

The current native networking UI keeps the gateway on loopback. It does not offer a simple direct-HTTP LAN bind. For another device, configure a trusted HTTPS reverse proxy on the server Mac or the supported Cloudflare connector, then use its HTTPS origin. A router port-forward or a raw LAN IP alone is not the supported replacement for that setup.

Cloudflare route checklist#

1. Verify the actual local origin and port in Administration.
2. In your own Cloudflare account, route the intended hostname through the existing intended tunnel.
3. Use an HTTP origin such as http://127.0.0.1:3615 only when it matches this Mac's active gateway.
4. Ensure the proxied hostname DNS target selects that same tunnel ID and that no earlier ingress rule shadows it.
5. Use Connections → Connect & verify and check process, tunnel identity, route, local health and public HTTPS separately.

A marketing landing page hosted on Pages is separate from the Media Center endpoint. Do not replace one hostname's DNS with the other just because both have Lumio in their name.

Proxy and session security#

Lumio validates configured Host/Origin and accepts HTTPS forwarding for its public hostname only across its local trusted proxy boundary. Keep public TLS, secure cookies, authentication and CSRF checks enabled. The private bundled engine endpoint is not for public exposure. Do not inject arbitrary forwarding headers from an untrusted network to make a failing route appear healthy.

Diagnose by hop#

Local success with public Cloudflare 1033 usually points to tunnel/DNS selection, not proof of a broken player. A 502/504 suggests origin reachability or timing; a 403 may involve an Access policy or application validation. Follow the exact staged message and current provider documentation rather than deleting/recreating a tunnel blindly.

Official references: Tunnel setup and Pages custom domains. Domain ownership, provider policy and network availability remain your configuration choices.