Firewall warning on corporate network

[maphew]

On Trilium startup this morning I was greeted with "Do you want to allow public and private networks to access this app?" from Windows Security. Since this is a corporately managed Windows network I'm not allowed to make firewall adjustments. The only option given is to cancel.

After cancel Trilium seems to operate as normal and syncing with my remote Trilium server which is outside the corporate network succceeds.

What is triggering the firewall access request? It doesn't appear to be necessary, can we stop or remove it? (I don't want the security folks to put Trilium on their "extra scrutiny maybe we don't want to allow" list. )

Trilium has been installed on this system for ~2 weeks, so I'm unsure why this warning has only come up now. Maybe a new group policy pushed out from central IT?

App version: 0.93.0
DB version: 229
Sync version: 34
Build date: Apr 17, 2025, 12:19:43 PM

OS Name: Microsoft Windows 11 Enterprise
OS Version: 10.0.26100 N/A Build 26100

Backend log snippet:

08:36:04.166 Table counts: notes: 3007, revisions: 709, attachments: 431, branches: 3058, attributes: 3983, etapi_tokens: 17, blobs: 3326
08:36:04.194 Slow query took 25ms: SELECT id, entityId FROM entity_changes LEFT JOIN notes ON entityId = notes.noteId WHERE entity_changes.isErased = 0 AND entity_changes.entityName = 'notes' AND notes.noteId IS NULL
08:36:04.292 Slow query took 58ms: SELECT notes.noteId, notes.type, notes.mime FROM notes JOIN blobs USING (blobId) WHERE isDeleted = 0 AND isProtected = 0 AND content IS NULL
08:36:04.301 All consistency checks passed with no errors detected (took 143ms)
08:36:05.582 Nothing to push
08:36:05.697 Sending message to all clients: {"type":"sync-pull-in-progress","lastSyncedPush":23980}
08:36:05.711 updated: {branches: [tQdJXN9cCfqM_AKssnxS9f2IE, AKssnxS9f2IE_NkXs5BLN9za3, O9DfsuFCGATd_062GnOnqdxag, _help_Dgg7bR3b6K9j__help_klCWNks3ReaQ, 
....snip...
_help_MEtfsqa5VwNi], blobs: [HrD81YG17Y3UmnsSDCZv], etapi_tokens: [YA2VubTT59MK]}, alreadyUpdated: 0, erased: 1, alreadyErased: 0
08:36:05.715 Sync KDBwf41lwE: Pulled 72 changes in 43 KB, starting at entityChangeId=53073 in 114ms and applied them in 19ms, 0 outstanding pulls
08:36:05.716 200 POST /api/tree/load with 25349 bytes took 0ms
08:36:05.719 200 POST /api/tree/load with 7124 bytes took 1ms
08:36:05.821 Finished pull
08:36:05.821 Nothing to push

[perfectra1n]

What typically triggers these notifications is that Windows believes the network that you're on has changed (e.g. it used to be what they deemed to be a "private" network and now it's "public"). Perhaps you tried to use Trilium while on some VPN. Perhaps Windows felt like classifying your WiFi as private or public now. Perhaps Windows woke up on the wrong side of the bed and thinks you're now on a completely different network for some random reason.

We can't disable the popup, as Trilium has networking functionality. It will open ephemeral ports on the machine as it makes outbound connections (e.g. to your Trilium sync server), so that popup will happen.

Hitting "cancel" just means that it won't allow for any firewall modifications to the "private" internal network, on your local workstation, of your corporate network.

Just because the popup happens doesn't mean that it will face any extra scrutiny. Given that it's already been syncing with your remote server, the scrutiny has already happened as network paths were established, and the .exe binary was executed on your machine.

[maphew]

hmmm, VPN might be it. When I work remotely I use VPN to remote desktop from outside-corp to my main workstation inside-corp. Thanks for the info, confusing as it might be.

[maphew]

fwiw, I haven't gotten any new firewall notices and have installed 2 or 3 releases since the OP on 2 different machines.

[youli42]

Trilium 客户端同样包含了完整的服务端功能：通过 http://127.0.0.1:37840/login 可以如同访问服务端一样在 web 中登录和编辑，这个功能允许在局域网中访问。

对于 Windows，如果需要在局域网中访问一个系统中的服务，需要打开防火墙，弹出窗口是一个便捷性的操作，允许快速配置防火墙。

综上，我认为这个配置不会影响 Trilium 的本地使用和同步功能（防火墙配置的是入站而非出站，默认允许的绝大部分出站行为）

The Trilium client also includes complete server functionality: you can log in and edit via the web just like accessing a server through http://127.0.0.1:37840/login, and this feature allows access within a local area network (LAN).

For Windows, if you need to access a service on a system within the LAN, you need to open the firewall. The pop-up window is a convenient operation that allows quick configuration of the firewall.

In summary, I believe this configuration will not affect Trilium's local usage and synchronization functions (the firewall configuration is for inbound rather than outbound traffic, and most outbound behaviors are allowed by default).

[eliandoran]

Upcoming desktop versions of Trilium should only listen on the loopback interface, so hopefully there will be no more a firewall prompt.