468
Jellyfin over the internet (startrek.website)

What’s your go too (secure) method for casting over the internet with a Jellyfin server.

I’m wondering what to use and I’m pretty beginner at this

top 50 comments
sorted by: hot top controversial new old

I keep jellyfin up to date in a container and forward tcp/8920 on my router to the container. Easy and plenty secure. People in this thread are wildly overthinking it.

[-] burgerchurgarr@lemmus.org 50 points 3 days ago

I just expose my local machine to the internet, unsecured

Thanks stranger over the internet seems like the best option.

[-] donalonzo@lemmy.world 8 points 3 days ago

This is absolutely unhinged but god damn it, I respect you.

[-] FrostyCaveman@lemm.ee 42 points 4 days ago* (last edited 4 days ago)

I think my approach is probably the most insane one, reading this thread…

So the only thing I expose to the public internet is a homemade reverse proxy application which supports both form based and basic authentication. The only thing anonymous users have access to is the form login page. I’m on top of security updates with its dependencies and thus far I haven’t had any issues, ever. It runs in a docker container, on a VM, on Proxmox. My Jellyfin instance is in k8s.

My mum wanted to watch some stuff on my Jellyfin instance on her Chromecast With Google TV, plugged into her ancient Dumb TV. There is a Jellyfin Android TV app. I couldn’t think of a nice way to run a VPN on Android TV or on any of her (non-existent) network infra.

So instead I forked the Jellyfin Android TV app codebase. I found all the places where the API calls are made to the backend (there are multiple). I slapped in basic auth credentials. Recompiled the app. Deployed it to her Chromecast via developer mode.

Solid af so far. I haven’t updated Jellyfin since then (6 months), but when I need to, I’ll update the fork and redeploy it on her Chromecast.

[-] EpicFailGuy@lemmy.world 17 points 4 days ago

What an absolute gigachad XD

[-] Couldbealeotard@lemmy.world 12 points 4 days ago
[-] FrostyCaveman@lemm.ee 12 points 4 days ago

VERY hands on, wouldn’t recommend it haha.

But that’s the beauty of open source. You CAN do it

[-] Player2@lemm.ee 6 points 3 days ago

For now just Tailscale but I'm working on setting up a reverse proxy and SSO through Authentik

[-] derpgon@programming.dev 2 points 3 days ago* (last edited 3 days ago)

Even more secure is having a VPS and self hosting Heascale, even better is Wireguard

[-] Player2@lemm.ee 1 points 2 days ago

I'm trying to move away from needing a VPN to connect to make it simpler for less technically inclined family members

[-] derpgon@programming.dev 3 points 2 days ago

Usually just needs to be set up once. A small price to pay for security.

[-] MrTolkinghoen@lemmy.zip 16 points 3 days ago

Tailscale with self hosted headscale

load more comments (2 replies)
[-] fmstrat@lemmy.nowsci.com 26 points 4 days ago

I used to do all the things mentioned here. Now, I just use Wireguard. If a family member wants to use a service, they need Wireguard. If they don't want to install it, they dont get the service.

load more comments (3 replies)

Nginx in front of it, open ports for https (and ssh), nothing more. Let's encrypt certificate and you're good to go.

[-] Novi@sh.itjust.works 72 points 5 days ago

I would not publicly expose ssh. Your home IP will get scanned all the time and external machines will try to connect to your ssh port.

[-] 30p87@feddit.org 53 points 5 days ago

fail2ban with endlessh and abuseipdb as actions

Anything that's not specifically my username or git gets instantly blocked. Same with correct users but trying to use passwords or failing authentication in any way.

[-] mosiacmango@lemm.ee 31 points 4 days ago* (last edited 4 days ago)

Youve minimized login risk, but not any 0 days or newly discovered vulnerabilites in your ssh server software. Its still best to not directly expose any ports you dont need to regularly interact with to the internet.

Also, Look into crowdsec as a fail2ban replacement. Its uses automatically crowdsourced info to pre block IPs. A bit more proactive compared to abuseipdb manual reporting.

load more comments (1 replies)
load more comments (31 replies)
load more comments (19 replies)
[-] Evil_Shrubbery@lemm.ee 61 points 4 days ago
load more comments (7 replies)
[-] smiletolerantly@awful.systems 33 points 4 days ago

I host it publicly accessible behind a proper firewall and reverse proxy setup.

If you are only ever using Jellyfin from your own, wireguard configured phone, then that's great; but there's nothing wrong with hosting Jellyfin publicly.

I think one of these days I need to make a "myth-busting" post about this topic.

[-] greywolf0x1@lemmy.ml 11 points 4 days ago

Please do so, it'll be very useful

[-] EncryptKeeper@lemmy.world 14 points 4 days ago* (last edited 4 days ago)

If you’re a beginner and you’re looking for the most secure way with least amount of effort, just VPN into your home network using something like WireGuard, or use an off the shelf mesh vpn like Tailscale to connect directly to your JF server. You can give access to your VPN to other people to use. Tailscale would be the easiest to do this with, but if you want to go full self-hosted you can do it with WireGuard if you’re willing to put in a little extra leg work.

What I’ve done in the past is run a reverse proxy on a cloud VPS and tunnel that to the JF server. The cloud VPS acts as a reverse proxy and a web application firewall which blocks common exploits, failed connection attempts etc. you can take it one step beyond that if you want people to authenticate BEFORE they reach your server by using an oauth provider and whatever forward Auth your reverse proxy software supports.

[-] Scavenger8294@feddit.org 21 points 4 days ago

for me the easiest option was to set up tailscale on the server or network where jellyfin runs and then on the client/router where you want to watch the stream.

[-] FoD@startrek.website 10 points 4 days ago

This is also what I do, however, each user creates their own tailnet, not an account on mine and I share the server to them.

This way I keep my 3 free users for me, and other people still get to see jellyfin.

Tailscale and jellyfin in docker, add server to tailnet and share it out to your users emails. They have to install tailscale client in a device, login, then connect to your jellyfin. My users use Walmart Onn $30 streaming boxes. They work great.

I struggled for a few weeks to get it all working, there's a million people saying "I use this" but never "this is how to do it". YouTube is useless because it's filled with "jellyfin vs Plex SHOWDOWN DEATH FIGHT DE GOOGLE UR TOILET".

load more comments (3 replies)
load more comments (1 replies)
[-] JRaccoon@discuss.tchncs.de 31 points 5 days ago* (last edited 4 days ago)

I see everyone in this thread recommending a VPN or reverse proxy for accessing Jellyfin from outside the LAN. While I generally agree, I don't see a realistic risk in exposing Jellyfin directly to the internet. ~~It supports HTTPS and certificates nowadays, so there’s no need for outside SSL termination anymore.~~ (See Edit 2)

In my setup, which I've been running for some time, I've port-forwarded only Jellyfin's HTTPS port to eliminate the possibility of someone ending up on pure HTTP and sending credentials unencrypted. I've also changed the Jellyfin's default port to a non-standard one to avoid basic port-scanning bots spamming login attempts. I fully understand that this falls into the security through obscurity category, but no harm in it either.

Anyone wanna yell at me for being an idiot and doing everything wrong? I'm genuinely curious, as the sentiment online seems to be that at least a reverse proxy is almost mandatory for this kind of setup, and I'm not entirely sure why.

Edit: Thank you everyone for your responses. While I don't agree with everything, the new insight is appreciated.

Edit 2: I've been informed that infact the support for HTTPS will be removed in a future version. From v10.11 release notes:

Deprecation Notice: Jellyfin’s internal handling of TLS/SSL certificates and configuration in the web server will be removed in a future version. No changes to the current system have been made in 10.11, however future versions will remove the current system and instead will provide advanced instructions to configure the Kestrel webserver directly for this relatively niche usecase. We strongly advise anyone using the current TLS options to use a Reverse Proxy for TLS termination instead if at all possible, as this provides a number of benefits

[-] makeitwonderful@lemmy.sdf.org 18 points 4 days ago

It feels like everything is a tradeoff and I think a setup like this reduces the complexity for people you share with.

If you added fail2ban along with alert email/notifications you could have a chance to react if you were ever targeted for a brute force attempt. Jellyfin docs talk about setting this up for anyone interested.

Blocking IP segments based on geography of countries you don't expect connections from adds the cost of a VPN for malicious actors in those areas.

Giving Jellyfin its own VLAN on your network could help limit exposure to your other services and devices if you experience a 0day or are otherwise compromised.

[-] domi@lemmy.secnd.me 16 points 4 days ago

Anyone wanna yell at me for being an idiot and doing everything wrong?

Not yell, but: Jellyfin is dropping HTTPS support with a future update so you might want to read up on reverse proxies before then.

Additionally, you might want to check if Shodan has your Jellyfin instance listed: https://www.shodan.io/

load more comments (3 replies)
[-] frezik 16 points 4 days ago

Nah, setting non-standard ports is sound advice in security circles.

People misunderstand the "no security through obscurity" phrase. If you build security as a chain, where the chain is only as good as the weakest link, then it's bad. But if you build security in layers, like a castle, then it can only help. It's OK for a layer to be weak when there are other layers behind it.

Even better, non-standard ports will make 99% of threats go away. They automate scans that are just looking for anything they can break. If they don't see the open ports, they move on. Won't stop a determined attacker, of course, but that's what other layers are for.

As long as there's real security otherwise (TLS, good passwords, etc), it's fine.

If anyone says "that's a false sense of security", ignore them. They've replaced thinking with a cliche.

load more comments (1 replies)
load more comments (10 replies)
[-] Netrunner@programming.dev 4 points 3 days ago

Sad that mTLS support is non existent because it solves this problem.

load more comments (1 replies)
[-] recall519@lemm.ee 7 points 4 days ago

Cloudflare. No public exposure to the internet.

[-] Batman@lemmy.world 9 points 4 days ago

Are we not worried about their terms of service? I've been using pangolin

[-] recall519@lemm.ee 6 points 3 days ago

I run multiple enterprise companies through it who are transferring significantly more sensitive data than me. I'm not as strict as some people here, so no, I don't really care. I think it's the best service, especially for free, so until things change, that's what I'm using.

[-] kalpol@lemmy.ca 5 points 3 days ago

We are, Batman, we are.

I VPN to my network for it.

load more comments (1 replies)
[-] PieMePlenty@lemmy.world 13 points 4 days ago

I access it through a reverse proxy (nginx). I guess the only weak point is if someone finds out the domain for it and starts spamming the login screen. But I've restricted access to the domain for most of the world anyway. Wireguard would probably be more secure but its not always possible if like on vacation and want to use it on the TV there..

load more comments (4 replies)
[-] ohshit604@sh.itjust.works 6 points 4 days ago* (last edited 4 days ago)

“Technically” my jellyfin is exposed to the internet however, I have Fail2Ban setup blocking every public IP and only whitelisting IP’s that I’ve verified.

I use GeoBlock for the services I want exposed to the internet however, I should also setup Authelia or something along those lines for further verification.

Reverse proxy is Traefik.

[-] snowflocke@feddit.org 9 points 4 days ago

We have it open to the public, behind a load balancer URL filtering incomming connection, https proxied through cloudflare with a country filter in place

[-] xnx@slrpnk.net 16 points 4 days ago
load more comments
view more: next ›
this post was submitted on 26 Jun 2025
468 points (100.0% liked)

Selfhosted

46672 readers
826 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS