# Remote access — GivEnergy Insight 1.4.0 on Synology

## How remote monitoring works

GivEnergy Insight continues reading the inverter from the NAS across the local
network. A remote browser connects to DSM and DSM proxies the authorised app
requests to the package's loopback-only service. The inverter does not need a
public port.

## Remote Access Setup in the app

Open GivEnergy Insight locally or through a direct DSM address, then select
**Remote Access** in the sidebar. The page can:

- save the protocol, DDNS hostname and external DSM port in that browser;
- generate the complete protected DSM application address;
- copy or open the address;
- test whether the address responds to the current browser;
- identify private/local addresses and unencrypted HTTP;
- reject QuickConnect relay hostnames and ports `8899` and `43819`.

The app does not make router, DSM firewall, certificate or DDNS changes. Complete
those settings in DSM and the router, then return to the page to test the result.

## Local address

```text
http://NAS-IP:5000/webman/3rdparty/GivEnergyInsight/index.cgi?runtime=dsm
```

Example:

```text
http://192.168.0.179:5000/webman/3rdparty/GivEnergyInsight/index.cgi?runtime=dsm
```

## External IP and port-forwarding example

Suppose the router forwards:

```text
External TCP port 7500 → NAS 192.168.0.179 TCP port 5000
```

The remote URL is:

```text
http://ExternalIP:7500/webman/3rdparty/GivEnergyInsight/index.cgi?runtime=dsm
```

Replace `ExternalIP` and `7500` with the real public address and router port.
The word is **port**, not “post”.

Version 1.4.0 intentionally uses this DSM third-party application path so
the same package installs on DSM 7.1.1 and newer releases. The older
`/givenergyinsight/` shortcut depended on a package resource that DSM 7.1.1
reserves for Synology packages.

## Recommended HTTPS configuration

Public HTTP does not encrypt DSM credentials or inverter data. Do not sign in to
DSM over public HTTP.

Recommended options:

1. Configure Synology DDNS and a trusted TLS certificate.
2. Forward an external HTTPS port to DSM HTTPS port `5001`.
3. Record the public hostname and router HTTPS port under
   **Control Panel → External Access → Advanced**.
4. Enter the same hostname and external HTTPS port on the app's
   **Remote Access** page.
5. Open:

```text
https://YOUR-DDNS-HOSTNAME:EXTERNAL-HTTPS-PORT/webman/3rdparty/GivEnergyInsight/index.cgi?runtime=dsm
```

Alternatively, connect to the home network through a trusted VPN or Tailscale
and use the NAS private address.

## DSM sessions

DSM browser sessions are specific to an address. A session created at
`192.168.0.179` is not automatically valid at a public IP or DDNS hostname.
Sign in again using the remote hostname in the same browser, then open the app.

If the GivEnergy Insight sign-in portal appears, use a DSM account permitted to
open the package. Two-factor authentication codes are supported.

## QuickConnect

QuickConnect relay is not a supported path for this third-party package.
Synology displays “this package cannot be accessed when connected via
QuickConnect” before GivEnergy Insight starts, so the app cannot override that
restriction. The Remote Access page detects and rejects `quickconnect.to` and
`quickconnect.cn` addresses. Use DDNS with HTTPS, a direct DSM port or a VPN.

## Ports

| Purpose | Typical port | Internet exposure |
| --- | ---: | --- |
| DSM HTTP | 5000 | Avoid for remote sign-in |
| DSM HTTPS | 5001 | Forward only when securely configured |
| GivEnergy inverter Modbus | 8899 | Never forward |
| GivEnergy Insight internal service | 43819 | Never forward |

The internal service listens only on NAS loopback and is reached through the
package's protected DSM CGI bridge.

## Testing correctly

Test from a genuinely external connection, such as a phone with Wi-Fi disabled.
Some routers do not support NAT loopback, so their public IP may fail from inside
the home even when it works externally. A successful in-app browser test means
the address responded; it does not replace an external mobile-data test.