Trusted_Networks / Allow_Bypass_Login / Split DNS / NAT Rewriting

[nonlinearsugar]

Spent maybe 20 hours trying to figure out why my allow_bypass_login/trusted_networks configuration wasn't working until I remembered that Google IOT sometimes bypasses my DNS. Packet capture confirmed the issue and a NAT rule to redirect all DNS requests from 8.8.8.8 and 8.8.4.4 to my local DNS fixed the issue. This ensured my Chromecasts are connecting to HomeAssistant without NAT rewriting their IPs.

Might be worth a quick clarification in the trusted networks section or troubleshooting section to verify whether traffic from the Chromecasts is being NAT'd/IPs are being rewritten. If nothing else hopefully posting this issue will help someone else in the future.

[baudneo]

Another good point, after I spent an hour banging my head against the wall, and is pointed out in the HASS documentation:

You cannot trust a network that you are using in any trusted_proxies. The trusted_networks authentication will fail with the message: Your computer is not allowed

I had added my network 10.0.1.0/24 to the trusted_proxies.yaml file. During testing the display is on that same network with an IP of 10.0.1.42/32. There were no errors in the logs, just the login screen with user and password boxes.

I use cloudflared, so I had to add my cloudflared host IP to the trusted proxies file. After restarting hass, the dash is casting properly.