Limits and refusals

The relay’s port is open to the internet, so the relay protects itself. The defaults fit one app with one recorder of up to 32 channels.

Change them in the limits object of /etc/watchpost/relay.json, then apply with:

sudo systemctl reload watchpost-relay

Open tunnels stay up and keep counting.

Settings

Setting	Default	What it limits
deviceConnections	48	Simultaneous tunnels to one device, all ports and all tokens together
devices	none	Own limits for chosen devices, by the address the hub sees (10.77.N.x)
clientConnections	32	Simultaneous TCP connections from one client address (IPv6: per /64). Extra ones close before TLS
freeFailures	5	Wrong tokens from one address before pauses begin
pauseSeconds	1	The first pause. Each next one is twice as long
maxPauseSeconds	300	The longest pause

A weak recorder

An old recorder fails when the app opens too many connections. One 2019 NVR lost both DVRIP and RTSP after two playbacks. The limit counts per device because the device fails as a whole, not port by port.

For a recorder like that, with one or two cameras, set a low limit for its address:

"limits": {
  "devices": { "10.77.1.9": 6 }
}

A second app now gets a refusal at login and never reaches playback.

Wrong tokens

After five wrong tokens from one address, every request from it is refused for a second. The next pause is two seconds, then four, and so on up to five minutes. A correct token is refused during a pause too, otherwise the pause would not slow down guessing. After a pause, a correct token resets the count, and an address with no errors for 15 minutes is forgotten.

Clients behind one carrier NAT share the count.

Refusals

Every refusal carries a Watchpost-Refusal header with the reason.

Request	Status	Watchpost-Refusal	What it means
Tunnel, token missing or wrong	407	token	The site’s access token is wrong, or the site is gone from the hub. Run the setup for the site again
Tunnel, address or port outside the token	403	target	The device is not on the site’s list, or the port is not a device port (80, 443, 554, 8000, 8899, 34567). After adding a device, make the script again
Tunnel, the token’s tunnels are all busy	429	token-limit	The site has used its tunnels
Tunnel, the device’s tunnels are all busy	429	device-limit	Close another viewer, or raise the limit for this device
Tunnel, client address paused	429	client-paused	Too many wrong tokens. Wait for the Retry-After seconds
Tunnel, device did not answer	502 or 504	unreachable	The device does not answer the hub. Check the site’s tunnel and the device
API, wrong admin token	401	token	The admin token does not match the hub
API, a site’s token changed	409	none	A site’s token cannot change. Remove the site and add it again