admin interface specific networks

[MystixCode]

Is it possible to make the https admin interface only reachable from specific internal networks but client interface from everywhere without installing a haproxy for that?
Couldnt figure it out in reasonable time.

[drakkan]

You can enable the admin UI on a specific ip:port and the web client UI on a different IP:port. Or you can you can set the allowed ip/mask on a per-admin basis: the UI will be reachable but admins will be able to login only if they connect from the allowed ip addresses

[anotherAccount111]

i was able to figure out the allowed ip/mask on per admin basis.
But i dont understand how to change the port only for admin ui.
All i see is the option that works for both admin and client:

Can someone give me a hint where to do that?

[JonBendtsen]

I don't use this function, but I think that because "bindings": [ ] is a list, then you should be able to have several different elements inside that list and each of them have their own different configuration like this example

[
  {
    "port": 8443,
    "address": "",
    "enable_web_admin": true,
    "enable_web_client": false,
    "enable_rest_api": true,
    "enabled_login_methods": 0,
    "enable_https": true,
    ... },
  {
    "port": 443,
    "address": "",
    "enable_web_admin": false,
    "enable_web_client": true,
    "enable_rest_api": false,
    "enabled_login_methods": 0,
    "enable_https": true,
    ... }
] 

[cloudlady911]

I tested this and it worked for me. Don't forget to open the port in your security group.

[MystixCode]

Cool thx. I have set the allowed ip:mask, but this method is better. I may change when i touch that system again.