3 ms·

I ridiculously love Jellyfin. I have found that if my Jellyfin box is IPv6 and I map a domain to that address, such as free DNS from Cloudflare, then I can acce

I ridiculously love Jellyfin. I have found that if my Jellyfin box is IPv6 and I map a domain to that address, such as free DNS from Cloudflare, then I can access my personal media from anywhere on the internet. What I haven’t found is a way to restrict access to known devices, such as MAC address, so that big companies don’t sue me to death. Yes, I know Jellyfin has a login prompt, but I would prefer better security beyond Jellyfin as a just in case.

nativeit 2y ago
You could use TailScale or Zerotier, join all your devices to a private subnet, then use UFW on the Jellyfin server to deny all connections except those from your private subnet. Then all your devices in your Tailscale/Zerotier account can access one another from anywhere. Also works for shared folders in Windows, remote desktop, SSH, etc.. It's easy enough so that most enthusiasts can handle it without being 100% proficient in a Linux shell, VPNs, or firewalls. Should be lots of guides available with these ingredients.
- chgs 2y ago
  Or you could just WireGuard to your jelling server direct
danparsonson 2y ago
You should absolutely hand off the security to something else - just exposing this publicly is asking to get hacked. I use Wireguard for my private online stuff, that works nicely. Expose Jellyfin only on the loopback address and use Nginx to forward your domain to it, then setup your DNS entry to be the VPN address of your server. Just be aware that if you have your own local DNS server then you might need to configure it to allow serving up DNS entries with private network addresses in them, as these are often blocked for security reasons; or else just modify your /etc/hosts equivalent to manually add the mapping.
- mavamaarten 2y ago
  Can you easily use your services on mobile devices that way? I currently reverse proxy every service I need through nginx, but I kinda feel like this isn't enough security-wise. I did blacklist most countries and don't expose any port other than 80+443. Does it require you to run a VPN app on your phone constantly and does that cause troubles?
  - danparsonson 2y ago
    Yes you would need the Wireguard app on your phone, and certainly for me it works beautifully (I use Android - I can't speak for the iOS app but there is one). I don't actually remotely host Jellyfin, but I do use a range of other things like Bitwarden, Nextcloud, Dovecot/Postfix, and some small web apps, and it's really smooth. The only public port on the server is the VPN.
  - TheDong 2y ago
    iOS etc have wireguard clients, but I personally have found it much easier to configure a long random path as part of the server URL and use that as a "password". (https://server.com/$randomPath/ https://server.com/$randomPath/ It's not ideal, since the password's obviously saved in any user's browser history, but it's less of a pain than dealing with a VPN, especially since I let friends use the server, and it's secure enough for my threat model.
    - danparsonson 2y ago
      The trouble with that is that you still have to make 80/443 public, which means you have to trust that your web server will stand up to 24/7 probing. I guess I'm a bit more paranoid than I really need to be but if the port isn't open then the chances of a bad guy getting in that way because of a zero-day or because I forgot something should be zero. Hopefully you at least have something like fail2ban installed?
      - TheDong 2y ago
        If someone is going around popping up-to-date nginx servers, then they have much bigger targets than my media server, and I also have much bigger problems. My threat model does not include someone using an nginx zero-day to find out what movies I'm watching.
anon7000 2y ago
You can use a reverse proxy like Caddy or nginx to block, eg, non-local IPs, do subdomain routing, manage certs.
nazgul17 2y ago
I setup a VPN with OpenVPN, I can access Jellyfin from anywhere provided I have a login and key.
atoav 2y ago
You want a VPN (nost likely wireguard) with an exit point in your LAN. My router has that option.
jrace 2y ago
you can whitelist incoming IPs on Jellyfin.
Sanzig 2y ago
I use Tailscale for this, it works great. It's super simple to set up, you can do it in 15 minutes. Install Tailscale on your Jellyfin server and on your personal devices, create a tailnet and connect them to it. That's it, you're done. You can now access Jellyfin from any of the devices using the Tailscale IP or hostname of the Jellyfin server.
ang_cire 2y ago
I've been using CF tunnels to expose my jellyfin instance, with github oauth in front to prevent brute forcing.
TheDong 2y ago
A lot of people are suggesting VPNs, or putting oauth or such in front of it. Unfortunately, oauth doesn't work since the jellyfin clients (like the android tv client, iOS client, etc) don't understand oauth. Using VPNs is annoying if you want to share it with a friend, or you want to use it on a random third-party device, like a TV in a hotel or something. I think all Jellyfin clients all support appending a path to the URL, so adding a password in the form of a long random path works pretty well in my opinion, i.e. https://my-jellyfin-server.com/ahY9eig3/ And you can then just have the server return 404 or such to all other requests, you can send the link like normal to friends, and you can manually type it in if you need to. That should be enough to avoid some random copyright scanner.
- deleted 2y ago
  [deleted]

nativeit 2y ago

You could use TailScale or Zerotier, join all your devices to a private subnet, then use UFW on the Jellyfin server to deny all connections except those from your private subnet. Then all your devices in your Tailscale/Zerotier account can access one another from anywhere. Also works for shared folders in Windows, remote desktop, SSH, etc.. It's easy enough so that most enthusiasts can handle it without being 100% proficient in a Linux shell, VPNs, or firewalls. Should be lots of guides available with these ingredients.

chgs 2y ago
Or you could just WireGuard to your jelling server direct

danparsonson 2y ago

You should absolutely hand off the security to something else - just exposing this publicly is asking to get hacked. I use Wireguard for my private online stuff, that works nicely. Expose Jellyfin only on the loopback address and use Nginx to forward your domain to it, then setup your DNS entry to be the VPN address of your server. Just be aware that if you have your own local DNS server then you might need to configure it to allow serving up DNS entries with private network addresses in them, as these are often blocked for security reasons; or else just modify your /etc/hosts equivalent to manually add the mapping.

mavamaarten 2y ago
Can you easily use your services on mobile devices that way? I currently reverse proxy every service I need through nginx, but I kinda feel like this isn't enough security-wise. I did blacklist most countries and don't expose any port other than 80+443. Does it require you to run a VPN app on your phone constantly and does that cause troubles?
- danparsonson 2y ago
  Yes you would need the Wireguard app on your phone, and certainly for me it works beautifully (I use Android - I can't speak for the iOS app but there is one). I don't actually remotely host Jellyfin, but I do use a range of other things like Bitwarden, Nextcloud, Dovecot/Postfix, and some small web apps, and it's really smooth. The only public port on the server is the VPN.
- TheDong 2y ago
  iOS etc have wireguard clients, but I personally have found it much easier to configure a long random path as part of the server URL and use that as a "password". (https://server.com/$randomPath/ https://server.com/$randomPath/ It's not ideal, since the password's obviously saved in any user's browser history, but it's less of a pain than dealing with a VPN, especially since I let friends use the server, and it's secure enough for my threat model.
  - danparsonson 2y ago
    The trouble with that is that you still have to make 80/443 public, which means you have to trust that your web server will stand up to 24/7 probing. I guess I'm a bit more paranoid than I really need to be but if the port isn't open then the chances of a bad guy getting in that way because of a zero-day or because I forgot something should be zero. Hopefully you at least have something like fail2ban installed?
    - TheDong 2y ago
      If someone is going around popping up-to-date nginx servers, then they have much bigger targets than my media server, and I also have much bigger problems. My threat model does not include someone using an nginx zero-day to find out what movies I'm watching.

anon7000 2y ago

You can use a reverse proxy like Caddy or nginx to block, eg, non-local IPs, do subdomain routing, manage certs.

nazgul17 2y ago

I setup a VPN with OpenVPN, I can access Jellyfin from anywhere provided I have a login and key.

atoav 2y ago

You want a VPN (nost likely wireguard) with an exit point in your LAN. My router has that option.

jrace 2y ago

you can whitelist incoming IPs on Jellyfin.

Sanzig 2y ago

I use Tailscale for this, it works great. It's super simple to set up, you can do it in 15 minutes. Install Tailscale on your Jellyfin server and on your personal devices, create a tailnet and connect them to it. That's it, you're done. You can now access Jellyfin from any of the devices using the Tailscale IP or hostname of the Jellyfin server.

ang_cire 2y ago

I've been using CF tunnels to expose my jellyfin instance, with github oauth in front to prevent brute forcing.

TheDong 2y ago

A lot of people are suggesting VPNs, or putting oauth or such in front of it. Unfortunately, oauth doesn't work since the jellyfin clients (like the android tv client, iOS client, etc) don't understand oauth. Using VPNs is annoying if you want to share it with a friend, or you want to use it on a random third-party device, like a TV in a hotel or something. I think all Jellyfin clients all support appending a path to the URL, so adding a password in the form of a long random path works pretty well in my opinion, i.e. https://my-jellyfin-server.com/ahY9eig3/ And you can then just have the server return 404 or such to all other requests, you can send the link like normal to friends, and you can manually type it in if you need to. That should be enough to avoid some random copyright scanner.

deleted 2y ago
[deleted]