Because he’s right. You can’t access your own server remotely without plex’s infrastructure (provided you don’t just set up that infrastructure yourself). You don’t need to open ports or anything. Your server reaches out to plex server, which creates an entry point to your network. Your stream is then either routed through their servers or possibly setup as P2P stream.

How do you do this on Jellyfin? The only ways I'm familiar with is to expose Jellyfin to the internet or access it through Tailscale, would love to hear alternatives.

Edit: From the replies I think that either I don't understand how this feature works or many people here don't, so I'll give an overview of my understanding and explain why this is different from anything you can do on Jellyfin and what's the closest you can come.

You are running Plex-home in your house, Plex-home connects to Plex-server hosted by Plex and establishes a reverse connection that's only accessible by Plex-server, i.e. you can't access your Plex-home outside of your house. When you login on Plex you're logging in to Plex-server and if you're in the same network as Plex-home you get redirected to form a direct connection with it, if not (and for me Plex keeps failing this verification) you connect to Plex-server and every request you make gets forwarded to Plex-home and when you ask for media it gets routed through Plex-server. This is very different from exposing Plex-home directly to the internet, in order for someone online to access your Plex-home they need to have taken control of Plex-server and then they're limited by the API between those two (whichight be different from the Plex-home API) to try to escalate into your machine.

With Jellyfin there's no server side component, you access Jellyfin directly every time, so in order to access Jellyfin outside of your house it needs to be accessible for everyone. The closest you can come up with is using a third party authentication server, for example by having a VPS running Authentik/Authelia/etc and hosting Jellyfin behind that authentication. This gets you a similar level of security because someone would need to compromise your Auth and then your Jellyfin to get into your server. However I'm not sure Jellyfin clients would know how to handle a third party authentication service, and would probably just crap their pants and prevent you from logging in. You could still access it in a browser, but not on native clients like the one on your TV or Fire Stick.

If you don't have this VPS with authentication you're exposing Jellyfin directly to the internet, which means that any flaw in Jellyfin security immediately compromises your home server. And while I don't expect there to be many big or obvious flaws, there's a reason why stuff like Authelia or Authentik exists, and besides the convenience of a SSO they exist because proper authentication is hard and has many pitfalls, and they offer security in the knowledge that their main focus is authentication, whereas on most other services authentication is just one of the features they offer so it might not be as secure.