Tailscale. It's free. Insanely easy to set up.

Just install on your devices and connect via the given tailscale ip for the jellyfin server.

That's the whole point of a domain. Your IP changes every now and again you need people to know where to reach you. You give them a domain, and you configure the name records so that the domain always points to the right IP address.

Your options:

• dynamic IP - you keep your setup as is and just periodically tell them the new IP you're on. Annoying and exposed
• static IP - you buy a static IP (from your ISP) and share it with your friends once. A little bit less annoying and still exposed
• you use a VPN like hamachi or radmin - your friends install the software, they look for you IP in there, you're done - very secure but also very annoying
• you buy a domain - you have to configure an IP updater like ddclient or similar, then you jellyfin should be reachable - least annoying for your friends but also slightly less secure

Domain is the cleanest option.

I am telling you how annoying it is because that's how likely your friends are to adopt it and how secure it is because depending on your country you are doing something illegal and you really don't want anyone to find out and you gotta keep it updated more often if you don't want people to exploit it. There's an endless supply of very smart people out there who use known bugs to target public services.

Edit: I forgot DDNS, see below comments.

wanted a free solution

ends up buying a domain

Welcome to the club, buddy!

https://netbird.io/ for your own private network of trusted devices, it's free and doesn't require a separate Big Tech account to use (unlike Tailscale)

And then if you want to share Jellyfin with someone who isn't in your Netbird network... believe it or not, also Netbird

https://docs.netbird.io/manage/reverse-proxy

Personally I didn’t want to have to hand out VPN credentials to everyone, so I went with a cloudflare tunnel with Authelia as the method of authentication.

A VPN such as Tailscale.

@Vegan_Joe — if you’re still stuck, try this: install Tailscale → join your tailnet → expose Jellyfin container port 8096 as 443. That’s it. No nginx, no static IP hunting. I wrote a 3-command cheatsheet here https://cxgo.ai/l/5bwrT9m that I wish existed when I started fumbling with docker-compose overrides. Works on a $20 raspberry pi and a 2014 Mac mini, so your hardware shouldn’t matter.

Yes, a VPN. And dynamic DNS if you don't have a static IP address.

for a beginner with just a few remote clients, tailscale all the way.

though I still like doing it the old way with a custom nginx setup, fail2ban and a domain name, but its more work to make it secure and even then it's still somewhat of a liability.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

[Thread #41 for this comm, first seen 5th Jul 2026, 18:30] [FAQ] [Full list] [Contact] [Source code]

An easy way? I guess the term 'easy' depends on your expertise with networking, firewalls, etc. Sounds like you and I are at about the same level there. In which case the answer is: no, there's no easy way from what I can tell. I've looked into it and it's a lot more involved than, say, Plex (because Plex does a bunch of the routing and stuff for you, but at a cost).

I'm using wireguard with wg-easy. It's a gui that let you easely setup wireguard. My isp is giving a fixed ipv4. So i don't have to think about dns or other complicated things. I have Jellyfin and wg-easy installed on truenas as docker apps.

There are official app for any os you want.

https://www.wireguard.com/install/

You can still just open it to the internet. Just do it on IPv6 instead. You won't find it by scanning IP ranges like they do on IPv4. You'll want to set up DNS for it though. Also get a free TLS cert from LetsEncrypt. It's a bit of work initially.

I ended up using duckdns for a free domain. It sucks that I had to tie it to a google account, and maybe one day this might be an area where I buy a proper domain instead.

I have a glinet Flint3 router that makes it easy to spin up Wireguard servers on it. It was a bit more finnicky, but eventually I was able to get into the advanced settings and configure the router to sync the dynamic IP with DuckDNS too.

So I have Wireguard on my phone and my wife's phone. We have one pair of close friends who have a connection on their router too (and vice-versa) and their own Jellyfin server.

As others have said, Tailscale is the most pragmatic solution. It's a mesh VPN based on Wireguard. It's implemented in such a way that you don't need a static IP and don't need to open any ports on your firewall. The caveat is that you either need to register an account on tailscale.com (it's free for small-scale use) or set up a self-hosted alternative like Headscale on a VPS. Then you have to install the Tailscale client on each of the hosts you want to access and log into your account.

Tailscale nodes will be accessible using an internal, private address in the 100.64.0.0/10 address space. You can also set up a split DNS that allows you to access your hosts using a DNS name like hostname.your-tailnet-name.ts.net.

@Vegan_Joe
try tailscale

You don't need a static IP, you just have to keep track of what your current dynamic IP is.

You can do this with either a free or a paid DNS service.

There are a few different 'free dns' services that will delegate a subdomain of theirs to you at no cost. Admittedly, I've never actually used one of these so their names escape me. Hopefully someone else can point one of those out if that's what you really want.

I purchased a domain via google domains, when they existed. It's now transferred to squarespace, because they bought out google domains a few years ago.

It was around $13/year when I first got it a decade ago. It's now around $28/year.

This allows me full control over the domain: I can use as many subdomains as I want to give each service I use it's own unique name. (Instead of using their own separate ports that you've gotta remember) My domain will also forward all inbound email to my gmail account; this lets me use email addresses like <servicename>@mydomain.example. This way, I don't share my real email and can immediately tell who sold my info to the highest bidder when I get spam. (I could also host my own email service if I really wanted, but I haven't bothered)

Add Cloudflare ontop (for free); and it can filter out known attacks, ddos attempts, geofence your services to regions you'll actually be in, provide/autorenew ssl certs for https, show you usage analytics, cache static data reducing server/network load, etc.

Ultimately, the paid option is well worth it IMO. $2/month (which I typically pay in 3-10 year blocks) is hardly anything.

/edit; vpns are good and all, but they require you to setup software on the remote device to connect to it, and that typically routes most if not all your traffic back to the vpn server then out to the internet. That can create speed/bandwidth issues.

A domain allows you to access your services from any Internet connection with 0 configuration on the client side. Just accessing it like any other website.

I also host a vpn directly from my network, that I access/find via my domain. This means I'm not dependent on a public service like tailscale, but can still add additional security to access private only services (stuff I don't expose to the open internet)

Personally I purchased a domain, and use Caddy for a reverse proxy. My ISP gives me a static IP for free, but I don't think that makes a difference in this situation. Tailscale would be safer but requires more setup from friends. My friends seem to like how simple the setup is, and I also use requestrr so they can add movies/shows via a discord command.

I use pangolin and subdomains on my domain. It works really well, and enables SSO login to all services on the network.