Remote access setup
Access your media server from outside your home. Port forwarding, DDNS, Tailscale, and reverse proxies.
How remote access works
Your media server runs on your home network behind your router. From inside your home, you reach it using its local IP (e.g., 192.168.1.10:32400). From outside your home, the internet can't see that local IP. You need to create a path through your router so external requests reach your server.
Step 1: Static local IP
Your server needs the same local IP every time it boots. If the IP changes, your port forwarding rule breaks.
- 1Log into your router (usually 192.168.0.1 or 192.168.1.1 in a browser).
- 2Find DHCP settings or Address Reservation.
- 3Reserve the current IP address for your server's MAC address.
- 4Reboot your server and confirm it gets the same IP.
Step 2: Port forwarding
- 1In your router, find Port Forwarding (sometimes under Advanced, NAT, or Virtual Servers).
- 2Create a new rule: Protocol = TCP.
- 3External/public port: pick something in the 20000-50000 range (not the default server port).
- 4Internal/private port: 32400 (Plex), 8096 (Emby/Jellyfin).
- 5Internal IP: your server's static local IP.
- 6Save the rule.
Tip
Don't use the default port (32400, 8096) as your external port. Using a random port in the 20000-50000 range avoids automated scanners and port conflicts.
In your media server settings, tell it about your external port. In Plex: Settings > Remote Access > Manual Port. In Emby/Jellyfin: Settings > Networking.
Step 3: Test it
- 1From your phone (on mobile data, not Wi-Fi), try accessing your-public-ip:your-port.
- 2Use canyouseeme.org to independently verify the port is open.
- 3In Plex: the Remote Access page shows a green/red indicator. Important: green means "testing" not "confirmed." Wait 30 seconds for it to settle.
Important
If Plex shows green briefly then turns red, remote access is NOT working. The green is just the testing phase. Don't assume it's fine until independently confirmed.
DDNS - keeping your address stable
Most home internet connections have a dynamic public IP that changes periodically. DDNS (Dynamic DNS) gives you a domain name (e.g., myserver.duckdns.org) that always points to your current IP.
Free options: DuckDNS, No-IP, FreeDNS. You install a small updater on your server or router that keeps the DNS record current. Then you access your server via the domain name instead of a raw IP.
Common problems
Double NAT
If your router connects to an ISP modem/router, you have two layers of NAT. Port forwarding on your router alone won't work. Fix: set the ISP device to bridge mode, or put your router in DMZ on the ISP device.
CGNAT
Some ISPs share one public IP among many customers. Your router's WAN IP and your public IP (ipchicken.com) will be different. Port forwarding is impossible with CGNAT. Solutions: ask your ISP for a real public IP, or use Tailscale.
VPN on the server
Running a VPN on the server machine often breaks remote access by routing server traffic through the VPN tunnel. Create a split-tunnel exception for your media server, or bypass the VPN for that process entirely.
Windows firewall
Windows set to "Public" network blocks inbound connections. Switch your network profile to "Private" in Network and Sharing Center.
The easy alternative: Tailscale
Tailscale is a free mesh VPN that bypasses all NAT issues. Install it on your server and on any device you want to connect from. They see each other as if they're on the same local network, regardless of firewalls, CGNAT, or double NAT.
It's the simplest solution if you can't get port forwarding working. No ports to open, no DDNS needed, works from anywhere. The only trade-off: everyone who wants to connect needs Tailscale installed.
Did this guide help?
Be the first to vote.
Related guides