Free tools Windows power users keep installed
One-click scans. No signup required.
You can run Jellyfin behind Traefik for remote access, but you do not have to expose it to the internet: local-only use and VPN access are valid alternatives. For a public reverse-proxy setup, Traefik handles incoming HTTPS requests and routes them to Jellyfin; use a subdomain for the simplest configuration, and configure Jellyfin to trust only the proxy addresses you control.
How Jellyfin and Traefik fit together
Jellyfin is the media server; Traefik is the reverse proxy in front of it. A client connects to Traefik, which routes the request to Jellyfin. If you use a domain, DNS points the chosen name to your server. Traefik can obtain and renew a TLS certificate so the browser-to-proxy connection uses HTTPS.
This arrangement can centralize certificate handling and routing for multiple services, but it is not a requirement for running Jellyfin. Jellyfin says it runs independently from the internet, although metadata providers will not work while offline. Remote access is optional, and Jellyfin lists VPN and reverse proxy options while advising against direct internet port forwarding: Jellyfin networking documentation.
Choose local, VPN, or public proxy access
Local-only access
For a home network without remote access, you can use Jellyfin locally without Traefik or a public domain. The default Jellyfin HTTP port is TCP 8096. Optional HTTPS defaults to TCP 8920. Local client discovery uses UDP 7359; it is for local discovery, not a service to expose to the internet. These defaults are documented in the Jellyfin networking guide.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
VPN access
A VPN lets remote devices join a private network rather than making Jellyfin publicly reachable. This can suit people who want remote viewing but do not need a public URL for general use. Follow your VPN software’s own setup and access controls; the Jellyfin documentation lists VPN as a remote-access approach.
Public access through Traefik
For access from ordinary internet-connected clients, you can publish a hostname through Traefik and keep Jellyfin behind it. Do not confuse this with forwarding Jellyfin’s own port directly to the internet. Jellyfin warns that direct exposure is not recommended; opening a port makes the service at that port reachable at the next network layer. Publish only the proxy entry points you need and protect other services on the host and network.
Rank #2
- Entry-level NAS Home Storage: The UGREEN NAS DH4300 Plus is an entry-level 4-bay NAS that's ideal for home media and vast private storage you can access from anywhere and also supports Docker but not virtual machines. You can record, store, share happy moment with your families and friends, which is intuitive for users moving from cloud storage, or external drives to create your own private cloud, access files from any device.
- Smart Photo Backup & AI Album: Automatically back up photos and videos from your phone in real time and keep growing family memories organized with AI-powered photo albums. Semantic search, custom learning, and recognition of people, objects, pets, and similar photos help you quickly find the moments you want. Duplicate photo removal also helps keep your library organized—ideal for families and users with large photo collections.
- User-Friendly App & Easy Setup: Connect quickly via NFC, set up simply and share files fast on Windows, macOS, Android, iOS, web browsers, and smart TVs. You can access data remotely from any of your mixed devices. What's more, UGREEN NAS enclosure comes with beginner-friendly user manual and video instructions to ensure you can easily take full advantage of its features.
- More Cost-effective Storage Solution: Unlike cloud storage with recurring monthly fees, A UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $629.99 for a NAS, while for cloud storage, you need to pay $719.88 per year, $1,439.76 for 2 years, $2,159.64 for 3 years, $7,198.80 for 10 years. You will save $6,568.81 over 10 years with UGREEN NAS! *NAS cost based on DH4300 Plus + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Your Data, You Control：No third-party clouds, no hidden access, UGREEN NAS provides a more secure and private data storage solution. It stores data locally on your private hard drives and does automatic backups. Thus, you can keep full control over it. The advanced encryption is TRUSTe certified in the United States and is awarded the first (and only) ETSI EN 303 645 certification mark for NAS products by TÜV SÜD Group.
Before configuring public HTTPS
- Decide on a hostname. A domain is needed for a conventional public hostname, but Jellyfin does not require one to run. Ensure its DNS record points to the address clients can reach.
- Check network reachability. For the documented reverse-proxy setup, Jellyfin says the router and firewall need TCP ports 80 and 443. Whether those ports can reach your server depends on your network and hosting provider; do not assume that opening them is safe without understanding what they expose.
- Choose an ACME challenge that fits your setup. The Traefik guide describes HTTP-01, TLS-ALPN-01 and DNS-01 certificate challenges. The right choice depends on your network access and control of DNS. Consult the current Traefik documentation for the version and challenge configuration you use.
- Secure Traefik’s dashboard. Jellyfin’s Traefik page warns that the dashboard may otherwise be internet-accessible and says to enable firewall or authentication protection, or disable it. Check IPv6 exposure too; an IPv4 firewall rule alone may not protect a service reachable over IPv6.
Use a subdomain unless you need a path
Subdomain: the straightforward choice
A hostname such as media.example.com gives Traefik a clear host rule for Jellyfin. It avoids coordinating a URL prefix with Jellyfin’s own base-URL setting. This is the simpler default when you control DNS and can dedicate a name to the server.
Subpath: requires matching settings
A path such as example.com/jellyfin is supported, but the proxy route and Jellyfin Base URL must agree. If they do not, links and requests may use the wrong path. Jellyfin also notes that a base path can interfere with integrations and clients, including DLNA, HDHomeRun, Sonarr, Radarr and MrMC. Changing or removing an existing Base URL may require a restart; stale paths can continue to return 404 errors. See the networking guide and the Traefik guide before choosing this layout.
Rank #3
- 【Build Your Own NAS & Homelab — Not Just Storage】 More than a traditional NAS, ZimaBlade 7700 is a flexible x86 mini server for building your own homelab, personal cloud, or Docker host. Perfect for DIY NAS, self-hosting, container apps, and even retro systems — not limited like typical ARM-based NAS devices.
- 【x86 Platform — Broad Compatibility, Real Freedom】 Powered by an Intel quad-core x86 processor, it runs a wide range of operating systems and software with native compatibility. Ideal for Linux, Docker, CasaOS, and more — designed for flexibility and experimentation rather than locked-down appliance use.
- 【16GB RAM for Smooth Multi-Service Workloads】 Handle file sharing, media streaming, backups, and multiple lightweight services at once. Optimized for low-power, always-on operation — a great fit for home labs and personal servers running 24/7.
- 【Smooth 4K Media Streaming — Plex Direct Play Ready】 Stream your personal media library smoothly with Plex and similar media servers. Supports 4K playback on compatible devices via direct play, delivering a reliable home media experience without the need for heavy transcoding.
- 【Complete 2-Bay NAS Kit — Ready to Build】 Includes power supply, 16GB RAM, metal drive cage for 2 HDD/SSD, and dual SATA cables — everything you need to start building your own NAS right out of the box.
Configure Jellyfin to recognize the proxy
When traffic passes through a reverse proxy, Jellyfin needs to know which proxy addresses are trusted so it can correctly use forwarded headers. In Jellyfin, add only the IP address or addresses of proxies you control under Known Proxies. Do not trust every address as a shortcut.
An incorrect trust configuration can make Jellyfin identify the proxy rather than the actual client, and can impair remote-access restrictions. Also confirm that the proxy supports WebSockets, which Jellyfin uses for client connections. Avoid recording full request paths in logs unless access to those logs is protected or sensitive URL data is censored: API keys can appear in URLs. Details are in Jellyfin’s reverse proxy documentation.
Rank #4
- High-Performance NAS with Powerful Procesor: DXP4800 Plus is ideal for small offices, & More. You can enjoy smooth performance and seamless collaboration, while making use of advanced features like Docker and virtual machines. It works semalessly across every device inluding Windows, macOS, Linux, iOS, Android or Google services and so on.
- Better Way to Store Than External Drives: NAS offers centralized storage, automatic backups, remote access, and a wide range of RAID options for easy data recovery even if a drive fails. Massive Storage Capacity: Never worry about storage limits again. With up 144TB capacity, you can store 50 million 1MB photos or 98K 1.5GB movies，5 million 30MB songs! *Hard Drives not included.
- Super-Fast Transfers: Back up 1GB in less than a second using either the 10GbE network port or the 10Gbps USB ports.
- Secure Private Cloud: Retain 100% data ownership with advanced encryption to protect your files. Flexible permission management makes it easy to protect your privacy when collaborating with others.
- AI-Powered Photo Album: Automatically organizes your photos by recognizing faces, scenes, objects, and locations. It can also instantly remove duplicates, freeing up storage space and saving you time.
Use Traefik’s example as a version-specific starting point
Jellyfin’s official Traefik example explicitly targets Traefik v2.x, so it is not a version-independent recipe. It uses Docker labels and a file provider; its host-networking layout routes to a static host address. Check the syntax against the Traefik version you install and adapt the routing, provider and network arrangement to your deployment: Jellyfin’s Traefik guide.
Do not treat the sample’s alternate port, old image tag, static IP, hostnames, ACME provider, credentials or dashboard settings as universal defaults. In particular, replace or protect the example’s insecure dashboard configuration. The guide’s sample is meant to demonstrate an approach, not prescribe values for every host.
Best Value
- Powerful Performance: Equipped with an Intel x86 quad-core processor and 4GB RAM, the F4-425 network attached storage effortlessly handles 4K transcoding and multitasking. The 2.5GbE port ensures ultra-fast file transfers and supports multi-user concurrent access
- Home Multimedia Hub: The F4-425 media server supports hardware-level 4K H.265 decoding, compatible with Plex, Emby, and Jellyfin for smooth HD video playback, with DLNA for seamless multi-device streaming. The Photos app features AI smart album and efficiently organizes millions of photos
- TNAS Mobile Full Control: Initialize setup for your F4-425 NAS storage via the TNAS Mobile app without a PC. The mobile app supports automatic photo and video backups, plus real-time local/remote synchronization, all managed through a single client
- Ultra-Quiet & User-Friendly: The F4-425 NAS server operates at just 21dB(A), suitable for quiet environments like bedrooms. Its tool-free Push-Lock design HDD trays enable to install HDDs in 10 seconds
- Massive Storage & Security: The F4-425 4-bay NAS supports up to 120TB storage (4 x 30TB for each bay), 50+ independent user accounts, and flexible TRAID / TRAID+ arrays, 30% more storage space than traditional RAID while ensuring data redundancy. SPC module and CloudSync (compatible with Google Drive, OneDrive, Dropbox) enable seamless cross-platform synchronization and uninterrupted data access. Additionally, TerraSync enables two-way sync between the F4-425 and PCs/Macs
Keep container configuration and media persistent
For Docker deployments, Jellyfin’s official container image is jellyfin/jellyfin. Persist the container’s /config and /cache directories and mount the media library from storage that will remain available across container recreation. A container can be replaced or updated; data that exists only in its disposable filesystem should not be assumed to survive.
Container networking depends on the features you need. Host networking is optional for general use but required for DLNA. Jellyfin says its containers are unsupported on Windows and macOS. These requirements and the storage setup are covered in the Jellyfin container guide. The documentation requires persistent storage but does not require a NAS, prescribe a drive type or capacity, or recommend a storage brand.
Quick Recap
Configuration checklist
- Choose the access model: keep Jellyfin local, use a VPN, or publish it through Traefik. Avoid direct port forwarding to Jellyfin.
- Choose a URL: use a subdomain for a simpler proxy rule, or set a matching Jellyfin Base URL if deploying under a path.
- Prepare DNS and network access: for public HTTPS, arrange the hostname, the needed reachability on TCP 80 and 443, and an ACME challenge appropriate to your DNS and network.
- Configure Traefik: check the example against your installed Traefik version, route to Jellyfin on the correct container or host network, and secure or disable the dashboard.
- Configure Jellyfin: add only your trusted proxy IPs under Known Proxies, verify WebSockets, and set the Base URL if using a path.
- Persist container data: keep
/configand/cachepersistent and mount media storage; use host networking if you require DLNA. - Test from the right places: confirm local playback first, then test the chosen remote-access method from outside your home network. Check both IPv4 and IPv6 reachability where applicable.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
