For secure Jellyfin access outside your home, put a reverse proxy in front of the server, serve it over HTTPS, and keep Jellyfin’s own application port off the public internet. Configure Jellyfin to trust only your proxy, pass WebSockets and the expected forwarded headers, then test from a network outside your home. If only a few devices need access, a private VPN-style network can avoid exposing a public Jellyfin endpoint altogether.
Decide whether Jellyfin needs to be reachable from the public internet
Jellyfin works without internet access, and its local discovery feature does not extend beyond the local subnet. If you only need remote access for a limited set of your own devices, consider a private VPN-style network instead of making a Jellyfin service publicly reachable. That approach adds setup on each client and on the network; the Jellyfin documentation cited here does not prescribe a particular VPN product.
As an Amazon Associate I earn from qualifying purchases.
If you choose public access, use a hostname and reverse proxy with HTTPS rather than forwarding Jellyfin’s application port directly. Jellyfin’s networking documentation says, “Opening a port directly to the Internet is therefore insecure and not recommended,” and recommends terminating HTTPS separately on a reverse proxy.
Understand which ports belong on which side
Jellyfin’s default application ports are 8096/TCP for HTTP and 8920/TCP for HTTPS when HTTPS is enabled. Port 7359/UDP is for local-network discovery, not internet access. In a reverse-proxy setup, remote traffic reaches the proxy, which forwards requests to Jellyfin on the internal network.
#1 Best Overall
- High-Performance NAS with Powerful Procesor: DXP4800 Plus is ideal for small offices, & More. You can enjoy smooth performance and seamless collaboration, while making use of advanced features like Docker and virtual machines. It works semalessly across every device inluding Windows, macOS, Linux, iOS, Android or Google services and so on.
- Better Way to Store Than External Drives: NAS offers centralized storage, automatic backups, remote access, and a wide range of RAID options for easy data recovery even if a drive fails. Massive Storage Capacity: Never worry about storage limits again. With up 144TB capacity, you can store 50 million 1MB photos or 98K 1.5GB movies，5 million 30MB songs! *Hard Drives not included.
- Super-Fast Transfers: Back up 1GB in less than a second using either the 10GbE network port or the 10Gbps USB ports.
- Secure Private Cloud: Retain 100% data ownership with advanced encryption to protect your files. Flexible permission management makes it easy to protect your privacy when collaborating with others.
- AI-Powered Photo Album: Automatically organizes your photos by recognizing faces, scenes, objects, and locations. It can also instantly remove duplicates, freeing up storage space and saving you time.
| Port | Purpose | Typical secure setup |
|---|---|---|
| 80/TCP | HTTP endpoint used by documented reverse-proxy arrangements, commonly to redirect to HTTPS or support certificate issuance. | Forward to the proxy only if needed for your chosen configuration; do not forward it to Jellyfin’s application port. |
| 443/TCP | HTTPS endpoint for remote clients. | Forward to the proxy, not directly to Jellyfin. |
| 8096/TCP | Jellyfin’s default HTTP application port. | Keep internal to the proxy-to-Jellyfin connection; do not expose it directly to the internet. |
| 8920/TCP | Jellyfin’s HTTPS application port when enabled. | It is not a substitute for a properly configured public proxy. Keep it off public forwarding unless a specific design requires it. |
| 7359/UDP | Local-network server discovery. | Do not forward it for remote access. |
The Jellyfin networking guide and reverse-proxy guide describe the port roles and proxy arrangement. UDP 443 is relevant only if you deliberately configure optional HTTP/3/QUIC; it is not required for a basic HTTPS setup.
Choose a proxy and point a hostname to it
Caddy
Jellyfin recommends Caddy for ease of use. Its guide demonstrates automatic HTTPS when a public domain’s A/AAAA records point to the server’s public IP. The proxy documentation describes forwarding TCP ports 80 and 443 to the proxy for its documented arrangements. Follow the current instructions for your chosen proxy and network topology rather than assuming every home router or DNS setup is identical.
Rank #2
- Watch Live TV and recorded shows from your Jellyfin server (additional hardware/services required)
- Stream your media to your Fire TV device
- View your collection in an easy to use interface
Automatic HTTPS generally does not require a DNS-provider API token. If your certificate flow does require one, restrict its permissions to the minimum needed; a broadly privileged token increases the consequences of exposure. See the Jellyfin Caddy guide for its current setup details.
Nginx, Traefik, HAProxy, or Apache
Jellyfin documents these alternatives, but describes them as having a greater learning curve than Caddy. Regardless of proxy, configure forwarded headers and WebSockets correctly. Use the relevant guide linked from the reverse-proxy overview; proxy syntax and behavior vary by product and version.
Rank #3
- Watch Live TV and recorded shows from your Jellyfin server (additional hardware/services required)
- Stream your media to your device
- View your collection in an easy to use interface
Set up HTTPS and route traffic through the proxy
- Choose a hostname. Create a public DNS record for the hostname you plan to use, pointing it to the appropriate public address for your setup. If your address changes, account for that using a suitable DNS arrangement.
- Forward only the proxy’s required public endpoints. For the documented Jellyfin reverse-proxy arrangements, route TCP 80 and 443 from the router to the proxy host. Do not forward TCP 8096 directly to Jellyfin. The proxy should connect to Jellyfin over the internal network.
- Configure the proxy-to-Jellyfin destination. Set the proxy’s upstream to the Jellyfin server’s internal address and application port. Keep this connection reachable only as required within your network.
- Enable a trusted certificate and HTTPS. Use a certificate from a trusted certificate authority and make sure plain HTTP redirects to HTTPS. Jellyfin discourages self-signed certificates because of security and client-compatibility problems; verify that the certificate is trusted by the devices you will use.
- Pass WebSockets through the proxy. Jellyfin clients use WebSockets for some functions. Ensure the proxy configuration supports WebSocket connections, not just ordinary HTTP requests.
Jellyfin’s networking guidance says it supports HTTPS but strongly recommends handling HTTPS termination separately on a reverse proxy. The networking guide and proxy guide provide the relevant guidance; consult the proxy’s current documentation for exact directives.
Tell Jellyfin which proxy it can trust
In Jellyfin’s Network settings, add the proxy’s IP address or addresses to Known Proxies. Jellyfin must know which proxy is allowed to supply forwarded client information; otherwise it may treat the proxy’s address as the client address or fail to interpret remote addresses as intended.
Rank #4
- Compatible with more than 320 printer models on the market
- Supports Multi-Protocol and Multi-OS, easy to set up in almost all network environments
- High-Speed microprocessor and USB 2.0 compliant printing port make processing jobs faster
- Simple setup and management, very easy to operate
- NOTE *** For more Printer Compatibility information, see the PDF File of Compatibility Guide under Product Guide & Documents
Check that the proxy sends the forwarded headers Jellyfin expects and that the resulting client IP is correct. This matters for remote-access restrictions and any rules based on client address. Trust only the proxy addresses you control, not arbitrary clients or broad address ranges without a specific reason. Jellyfin explains the forwarded-header and Known Proxy requirements in its reverse-proxy documentation.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Review access controls, port mapping, and logs
Limit who can connect
Review both server-level remote-access settings and each user’s remote-access permissions. Set the local-network ranges to match your actual LAN; an incorrect range can cause local devices to be treated as remote, or the reverse. Use the networking documentation when checking these settings.
Best Value
- 6-Bay HDD Storage + 7th-Bay NVMe Performance Tier - Combine massive archive storage with a dedicated high-speed NVMe workspace. Supports up to 212TB total storage capacity, including support for up to 6×30TB HDDs and 4×8TB NVMe SSDs for active projects, AI photo libraries, app storage, cache, and media workflows without slowing down your HDD array
- Intel Core i3 Performance for Modern NAS & Self-Hosting - Powered by a 12th Gen Intel Core i3-1215U processor with 6 cores and boost speeds up to 4.4GHz. Built to handle multi-user storage, media streaming, backups, self-hosted services, AI photo indexing, and multiple always-on applications with smooth performance
- Built-in 256GB System SSD + Advanced NVMe Architecture - Includes a dedicated built-in 256GB SSD for ZimaOS system storage, keeping the operating system isolated from your data drives. Advanced NVMe architecture enables faster app response, smoother indexing, and high-speed storage workflows
- Dual TBT4 + Dual 2.5GbE Hybrid Connectivity - Use ZimaCube as both a high-speed NAS and direct-attached storage system. Dual TBT4 ports support fast local workflows for Mac and PC creators, while dual 2.5GbE networking delivers fast backups, media access, and multi-device synchronization
- PCIe Expansion for Future Networking, Storage & AI Upgrades - Built with expandable PCIe architecture for advanced customization and future upgrades. Add faster networking, NVMe storage expansion, AI accelerators, or additional hardware as your workflow evolves
Disable automatic port mapping unless you need it
Jellyfin’s setup guidance recommends disabling automatic port mapping unless specifically required. The feature relies on UPnP, which Jellyfin identifies as associated with security concerns. Check the setup wizard or relevant server setting and leave automatic mapping off if you are managing router forwarding yourself.
Keep sensitive information out of proxy logs
Do not log full request URLs unless you have a deliberate, protected reason and understand the risk: authentication information such as an api_key can appear in a URL. Configure the proxy to omit or redact sensitive query parameters, and restrict access to retained logs. The warning appears in Jellyfin’s reverse-proxy documentation.
Quick Recap
Test remote access from outside your home
- Use a phone with Wi-Fi disabled, or another device connected through a genuinely external network.
- Open the public hostname with
https://and confirm the browser or client reports a trusted certificate without a warning. - Sign in with a permitted user and play media. Confirm playback works, not just that the sign-in page loads; this also helps reveal proxy or WebSocket issues.
- Check Jellyfin’s connection information or logs to confirm it sees the real client address rather than only the proxy’s IP.
- If access fails, verify DNS resolution, router forwarding to the proxy on the required ports, the proxy’s upstream address, certificate validity, WebSocket handling, Known Proxies, and the user’s remote-access permission.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
