I detect that TCP enabled only when Web Controller is enabled. Web Controller have authorization option, but TCP does not. This creates a big leak on VMIX security because if someone in the same network find that web controller is enabled, he can send TCP commands taking control of live or worst to destroy it (by adding even or even porn ;) ). It takes me max 1’ to detect IP/Port and 5’ to create a NodeJS remote controller. Also, hack is easier because it is impossible for someone to change the TCP port.

I think that

1) An authorization method for TCP connections (maybe on connect command or with a allow access pop up on VMix) must implemented
2) Also allow us to enable/disable TCP and change the Port Number (this will help us also to control more that one instance of VMIX)

Thank you in advance

EDIT : Until then personally I use firewall to protect my system by allowing access to specific MAC address but even this isn't too secure because remote attackers can find and duplicate this address.

It may take 1 minute to detect IP/Port but it should take no time whatsoever for the remote controller, just fire up Hercules and send any command you want. But let's face it, your streaming network should be isolated anyway, for example, there is no way to secure BlackMagic ATEM remote control and if I remember correctly, then Behringer audio mixers have also no security settings, you should just secure your network. Easy as that.

But, if vMix should implement authentication, then it should not be pop up, that messes up in a case when I have external controller/software which needs to reconnect - instant popup on the screen, not good. Since TCP has no good authentication way, the IP white list may be one of the best options.

Firewall is the key. VLAN can help as well. You should have your own router that assigns IPs and controls traffic inside your streaming network anyway and there you can have a firewall as well.

Not a single word from my posts should reflect that I'm against the authentication for TCP, if that's what you took away from my posts then you misunderstood. I completely agree with you regarding network security but you implied that "Of course only with Firewall or a dual NAT you can do that but it's not always possible." - I was just giving you a couple suggestions on how to tackle the problem. I have never had problems with my own router & firewall between the clients' network and our own local network. I have also denied the vMix TCP port on the firewall so it wouldn't leak through WAN, only usable in the LAN.

Anyway +1 to FR