ComfyUI --listen opens port 8188 to every network you're on. Name the address instead

Description and use

By specifying only the intended network addresses for --listen and configuring reverse proxies or VPNs appropriately, users can safely expose ComfyUI to remote devices while preventing unauthorized access.

Problem

Running ComfyUI with the --listen flag without specifying a restricted address exposes port 8188 to all network interfaces, allowing anyone who can reach the machine to queue workflows, view outputs, and upload files without authentication.

Outcome

By specifying only the intended network addresses for --listen and configuring reverse proxies or VPNs appropriately, users can safely expose ComfyUI to remote devices while preventing unauthorized access.

Workflow

• 1. Run "python main.py --listen" to start ComfyUI on all interfaces.
• 2. Verify listening interfaces with "ss -tlnp | grep 8188" (Linux) or equivalent commands on macOS/Windows.
• 3. To restrict access, specify allowed addresses: "python main.py --listen 127.0.0.1,100.101.102.103" or "python main.py --listen 127.0.0.1,192.168.1.50".
• 4. If using Tailscale, start ComfyUI after Tailscale connects and use "tailscale serve --bg 8188" to expose the service securely.
• 5. Avoid using "tailscale funnel" as it publishes the address to the entire internet.
• 6. Do not add "--enable-cors-header" without specifying an exact origin, as it disables the middleware that blocks cross‑site requests.
• 7. If behind a reverse proxy, ensure the proxy forwards the correct Host header (e.g., in nginx: proxy_set_header Host $host).
• 8. Keep ComfyUI‑Manager security_level at "normal" or "strong" and update to at least 0.28.0 to mitigate CVEs.
• 9. Optionally, add firewall rules to limit access to specific subnets (e.g., "sudo ufw allow from 192.168.1.0/24 to any port 8188 proto tcp").

Evidence

Almost every "use ComfyUI from another PC or your phone" guide says the same thing: add --listen. It works. It also does more than most people expect, because ComfyUI has no login.

Source

With ComfyUI-Manager installed, they also get whatever its security level allows.

Source

--listen takes an optional value. With no value, it becomes 0.0.0.0,::: every IPv4 and IPv6 interface.

Source

Start ComfyUI after Tailscale is connected, or binding that address fails.

Source

If your proxy log or ComfyUI prints "request with non matching host and origin ... returning 403", the proxy is sending a loopback Host while the browser's Origin is your domain.

Source