1 files changed, 19 insertions, 18 deletions

diff --git a/Jellyfin.Server/Middleware/IpBasedAccessValidationMiddleware.cs b/Jellyfin.Server/Middleware/IpBasedAccessValidationMiddleware.cs
index 4bda8f273..110290027 100644
--- a/Jellyfin.Server/Middleware/IpBasedAccessValidationMiddleware.cs
+++ b/Jellyfin.Server/Middleware/IpBasedAccessValidationMiddleware.cs
@@ -1,9 +1,11 @@
 using System.Linq;
 using System.Threading.Tasks;
+using Jellyfin.Networking.Manager;
 using MediaBrowser.Common.Extensions;
 using MediaBrowser.Common.Net;
 using MediaBrowser.Controller.Configuration;
 using Microsoft.AspNetCore.Http;
+using NetworkCollection;
 
 namespace Jellyfin.Server.Middleware
 {
@@ -38,36 +40,35 @@ namespace Jellyfin.Server.Middleware
                 return;
             }
 
-            var remoteIp = httpContext.GetNormalizedRemoteIp();
+            var remoteIp = httpContext.Connection.RemoteIpAddress;
 
             if (serverConfigurationManager.Configuration.EnableRemoteAccess)
             {
-                var addressFilter = serverConfigurationManager.Configuration.RemoteIPFilter.Where(i => !string.IsNullOrWhiteSpace(i)).ToArray();
+                // Comma separated list of IP addresses or IP/netmask entries for networks that will be allowed to connect remotely.
+                // If left blank, all remote addresses will be allowed.
+                NetCollection remoteAddressFilter = networkManager.RemoteAddressFilter;
 
-                if (addressFilter.Length > 0 && !networkManager.IsInLocalNetwork(remoteIp))
+                if (remoteAddressFilter.Count > 0 && !networkManager.IsInLocalNetwork(remoteIp))
                 {
-                    if (serverConfigurationManager.Configuration.IsRemoteIPFilterBlacklist)
+                    // remoteAddressFilter is a whitelist or blacklist.
+                    bool isListed = remoteAddressFilter.Contains(remoteIp);
+                    if (!serverConfigurationManager.Configuration.IsRemoteIPFilterBlacklist)
                     {
-                        if (networkManager.IsAddressInSubnets(remoteIp, addressFilter))
-                        {
-                            return;
-                        }
+                        // Black list, so flip over.
+                        isListed = !isListed;
                     }
-                    else
+
+                    if (!isListed)
                     {
-                        if (!networkManager.IsAddressInSubnets(remoteIp, addressFilter))
-                        {
-                            return;
-                        }
+                        // If your name isn't on the list, you arn't coming in.
+                        return;
                     }
                 }
             }
-            else
+            else if (!networkManager.IsInLocalNetwork(remoteIp))
             {
-                if (!networkManager.IsInLocalNetwork(remoteIp))
-                {
-                    return;
-                }
+                // Remote not enabled. So everyone should be LAN.
+                return;
             }
 
             await _next(httpContext).ConfigureAwait(false);