Skip to content

External Access

Backend.AI GO binds the OpenAI-compatible Continuum Router to 127.0.0.1 by default. Other devices cannot reach it until you explicitly enable external access.

This page covers the router (default port 39080), used by OpenAI-compatible clients. The Management API server (default port 8001), which serves the REST API, the MCP endpoint, and the desktop app itself, has its own separate External access switch under API > Management API; see MCP Endpoint for its security notes.

Configure external access

  1. Open API > General.
  2. Enable the TCP server if it is off.
  3. Confirm the router port. The current default is 39080.
  4. Enable External access and accept the warning. The router then binds to 0.0.0.0 instead of loopback.
  5. Open API > Security and review the authentication policy.
  6. Open API > Access keys and create an access key for remote clients.
  7. Allow the selected port through the host firewall only for the intended private network.

The port change takes effect when the router is enabled or restarted. The external-access toggle changes the bind address used by the router.

Connect from another device

Use the host's LAN address and the configured router port:

curl http://192.168.1.10:39080/v1/models \
  -H "X-API-Key: YOUR_ACCESS_KEY"

OpenAI-compatible clients use this base URL:

http://192.168.1.10:39080/v1

Security checklist

  • Keep external access off when it is not needed.
  • Do not expose the router directly to the public internet.
  • Require an access key for remote clients.
  • Restrict the firewall rule to a trusted subnet or specific clients.
  • Use a VPN or authenticated reverse proxy when traffic must cross an untrusted network.
  • Rotate a key immediately if it is disclosed.

0.0.0.0 accepts traffic on every network interface. An API key does not replace network-level filtering.

Troubleshooting

If a remote request fails:

  1. Confirm the router is running in API > General.
  2. Confirm the client uses the configured port, not the Management API port.
  3. Check that External access is enabled.
  4. Verify the firewall rule and LAN routing.
  5. Verify the key in API > Access keys.
  6. Test http://127.0.0.1:39080/v1/models on the host first.