Developers

[lucidstate]

I'd like to control my Roku from outside my network. I set up a port forward from my Roku to the outside world and tried the following from another network over the internet: http://<publicFacingIPofNetwork>:8060/query/active-app and it gave me a 403 error.

Access to 73.100.192.155 was denied

You don't have authorization to view this page.
HTTP ERROR 403

I'm not all that experienced with network stuff. It seems like I have the port forward setup correctly, but the Roku itself is not allowing the connection (likely a security feature). It works just fine from a device on the same network. Any ideas?

[joetesta]

I just tried and got the same results as you. I'd guess it's a security feature to only respond to LAN addresses? 

[renojim]

If it's something you really, really need (and I still can't figure out the use case for this) and you have a computer on the same network that you can SSH to, I've successfully used PuTTY and port tunnels.  I was just playing with tunnels at the time, so all I did was to see if I could get the "active_app" on my Mother's Roku.  I don't think you're going to get your phone's remote control app to work this way, but you can query things via the port 8060 web interface and I'm guessing using cURL to issue ECP commands should work.

-JT

[EnTerr]

"joetesta" wrote:
I just tried and got the same results as you. I'd guess it's a security feature to only respond to LAN addresses? 

I suspect it's a security enhancement in response to this incident
https://forums.roku.com/viewtopic.php?f=34&t=88160

[belltown]

It used to be possible to use ECP from outside the network, even using the Roku remote app. However, it was disabled, I think in the 7.1 firmware release  last year.

[joetesta]

"EnTerr" wrote:

"joetesta" wrote:
I just tried and got the same results as you. I'd guess it's a security feature to only respond to LAN addresses? 

I suspect it's a security enhancement in response to this incident
https://forums.roku.com/viewtopic.php?f=34&t=88160

Ha, wow!  Makes sense considering they implemented your suggestion #3.
Great suggestion by @renojim (ssh tunnel w putty) maybe that works for OP?