Photo Supreme Manuals
All manuals

Photo Supreme documentation

Search all manuals

Enter at least two characters.
    Manual contents
    1. Introduction
    2. Choose Who Should Be Able to Connect
    3. Prepare the Computer and Catalog
    4. Configure and Start the Embedded Server
    5. Configure the PSO Pages
    6. Router and Host-Firewall Rules
    7. Use an HTTPS Reverse Proxy
    8. Browser Origins and CORS
    9. Security and Privacy Checks
    10. Verify the Setup
    11. Troubleshooting

    Getting Started with Photo Supreme's Integrated HTTP Server

    Router and Host-Firewall Rules

    Apply the rules for your chosen access scope, rather than opening every port:

    DeploymentAllowKeep blocked
    Localhost onlyLocal loopback traffic.Incoming access to the embedded port from other computers.
    Direct LAN testTCP 12543 from the intended trusted LAN addresses, on the appropriate host-firewall profile.Internet forwarding of 12543, guest networks, and other untrusted networks.
    Reverse proxy on the same computerHTTPS TCP 443 to the proxy; local loopback from the proxy to 12543.Direct network access to 12543.
    Reverse proxy on another computerHTTPS TCP 443 to the proxy; backend TCP 12543 only from the proxy's private address.All other access to the backend port.

    The embedded listener currently binds to all IPv4 interfaces. There is no listening-address selector in the settings dialog. Setting the proxy upstream to 127.0.0.1 does not make the embedded server loopback-only: enforce the restriction with the host firewall and, where appropriate, network ACLs.

    For Internet access, forward the public HTTPS port only to the reverse proxy. Port 80 may also be needed for HTTP-to-HTTPS redirection or the selected certificate-validation method; follow your proxy/certificate setup. Do not forward the backend port, database ports, SMB/file-sharing ports, or remote desktop ports as part of this setup. Do not put the machine in a router's unrestricted "DMZ host" mode or disable the firewall to solve a connection issue.

    Review automatic router port mappings, router administration access, and guest Wi-Fi isolation. Check IPv6 firewall policy and DNS AAAA records as well as IPv4 rules: lack of an IPv4 port-forward does not secure an independently reachable IPv6 proxy or another service. Do not assume the embedded IPv4 listener provides native IPv6 access.

    For public hostnames, configure DNS to reach your proxy. A private server IP belongs in local DNS or the proxy's upstream settings, not in public browser configuration. Some home routers need split DNS or hairpin-NAT support to reach the same public hostname from inside the LAN. Carrier-grade NAT can prevent inbound port forwarding; an authenticated VPN may be more appropriate.