Jellyfin Remote Access: Setup, Tailscale, and VPN Options
Access Jellyfin outside your home with Tailscale, HTTPS reverse proxy, port forwarding, or a VPN, and fix connections that work only on your LAN.
Quick Answer
Jellyfin does not provide a hosted relay, so enabling Allow remote connections is only the first step. For your own devices, install Tailscale on the server and each client, then connect to the server's Tailscale address on TCP 8096. For family TVs and clients that cannot run a private VPN, publish Jellyfin through an HTTPS reverse proxy. Directly forwarding TCP 8096 can work, but Jellyfin warns that exposing a port to the internet is insecure and recommends HTTPS. If you would rather not troubleshoot router rules or CGNAT, use a VPN that explicitly assigns an incoming port and redirect that port locally to Jellyfin TCP 8096; an ordinary VPN without port forwarding will not make Jellyfin reachable.
Choose the Right Jellyfin Remote Access Method
Start with who needs access and what their device can run. The easiest setup for your phone is not always the easiest setup for a family TV.
Best starting point
Use Tailscale for private access
Install Tailscale on the Jellyfin server and every client, sign them into the same tailnet, and add http://SERVER-TAILSCALE-IP:8096 in the Jellyfin client. No router port or public IPv4 is required.
Open the Tailscale setupIs Jellyfin Remote Access Free?
Yes. Jellyfin does not charge a subscription fee for remote playback.
The software is free and self-hosted, but the connection is also your responsibility. A domain, VPS, commercial VPN, or public IP option from an ISP may cost money depending on the method you choose.
Jellyfin Remote Access Methods Compared
There is no single best method. Choose based on client compatibility, public-IP availability, and how much network administration you want to own.
| Method | Best for | Main requirement | Trade-off |
|---|---|---|---|
| Tailscale | Your own phones, laptops, and supported streaming devices | Tailscale on the server and every client | No public port, but client support can be awkward on some TVs |
| HTTPS reverse proxy | Family and standard Jellyfin apps | Domain, TLS, proxy, and a public route | Most compatible public option, but more setup and maintenance |
| Direct port forwarding | Short tests and experienced administrators | Public IP and one TCP mapping to 8096 | Simple, but exposing plain HTTP is not recommended |
| VPN with an incoming port | CGNAT when client VPN software is impractical | Provider-assigned port plus a local redirect to Jellyfin | Bypasses ISP NAT, but port behavior and locations vary |
Using a VPN for Jellyfin Remote Access
A normal privacy VPN does not make Jellyfin reachable. The VPN must explicitly allow unsolicited incoming traffic. The assigned public port then needs to reach Jellyfin on local TCP 8096, usually with a firewall or local port-redirect rule.
A VPN port is still a public doorway to Jellyfin; it is not a replacement for HTTPS, updates, strong accounts, or access controls. If every viewer can install Tailscale, that private route is usually simpler and safer.
PureVPN
Simplest fit when you want to choose the public port
Its paid port-forwarding add-on can open selected ports on supported locations. Open one TCP port and route it to the Jellyfin service; verify the current location and protocol support before buying.
Check current offerPrivate Internet Access
Good for a server where you can automate the assigned port
PIA displays an assigned forwarded port on supported VPN locations. Because Jellyfin normally listens on 8096, redirect the assigned port locally and update the rule if the assignment changes.
Check current offerProton VPN
Good desktop-platform coverage with a changing active port
Paid plans provide a random active port on supported P2P servers. The port usually changes after reconnecting, so a long-running Jellyfin server needs a matching redirect and an update routine.
Check current offerHow to Set Up Jellyfin Remote Access
Complete the local checks first. If Jellyfin does not work on your home network, no remote-access method can repair the server itself.
Confirm Jellyfin works on your LAN
From another device at home, open http://SERVER-LAN-IP:8096 and play a title. Record the server's local IP and reserve it in the router so later rules do not point to an old address.
Allow remote connections
In the Jellyfin administrator dashboard, open Networking > Remote Access Settings and allow remote connections. Also check Users > Edit User > Allow remote connections to this server for each account that should stream remotely.
Choose one public or private path
Use Tailscale for a private device-to-device path, an HTTPS reverse proxy for broadly compatible public access, or one incoming VPN port when CGNAT blocks router forwarding. Avoid stacking multiple methods while testing.
Open only the required local service
Allow TCP 8096 through the server firewall and any Docker or VM boundary. For a reverse proxy, keep 8096 private and publish TCP 80/443 to the proxy. Do not forward discovery UDP 7359 to the internet.
Add the correct server address to the client
Use http://100.x.x.x:8096 for a Tailscale IP, https://media.example.com for a reverse proxy, or the VPN/public host plus its assigned external port. Include any configured Base URL in the client address.
Test away from home
Turn off Wi-Fi on a phone, connect through cellular data, sign in, and play a title. A port checker alone proves only that something answered; successful remote playback proves the whole path.
Jellyfin Remote Access Ports
Jellyfin streaming uses TCP. The discovery port is local-only and should never be exposed as part of remote access.
TCP 8096
Default HTTP and web-client port. Use it inside the LAN, Tailscale, or behind a reverse proxy. Direct public exposure is not recommended.
TCP 8920
Default native HTTPS port when Jellyfin HTTPS is configured. Jellyfin recommends terminating HTTPS on a reverse proxy instead.
UDP 7359
Client discovery inside the local subnet. It does not provide remote streaming and should not be forwarded to the internet.
TCP 80 and 443
Common public ports for an HTTP/HTTPS reverse proxy. Forward them to the proxy, not directly to Jellyfin. UDP 443 is optional only when using HTTP/3.
Configure Each Remote Access Path
Tailscale: no port forwarding
Install Tailscale on the server host and client, join both to the same tailnet, then connect to the server's 100.x address on port 8096. This works without a public IP and is the cleanest solution for devices you control.
Reverse proxy: public HTTPS
Point a domain or dynamic DNS record to your public address, forward TCP 80/443 to the proxy, proxy requests to Jellyfin at 8096, enable WebSockets, and add the proxy IP under Known Proxies in Jellyfin.
Port forwarding: one TCP rule
Map one external TCP port to the Jellyfin server's reserved local IP at TCP 8096, allow it in every firewall layer, and test externally. Treat this as a diagnostic or advanced setup unless you add trusted HTTPS protection.
VPS tunnel: advanced public path
When clients need a normal public URL but the home network has CGNAT, a VPS can accept HTTPS and reach Jellyfin over an outbound WireGuard or Tailscale link. This requires server administration and bandwidth planning.
Jellyfin Remote Access Not Working
Check the first boundary where the request stops instead of repeatedly changing Jellyfin settings.
| What you see | Likely cause | First useful check |
|---|---|---|
| Works at home, times out remotely | No reachable public/private path, wrong destination IP, CGNAT, or firewall block | Test from cellular data, compare router WAN and public IP, then verify the single TCP route |
| Connection refused | Jellyfin is not listening on that interface/port or a container port was not published | Open the exact address locally and check the host, Docker, VM, and OS firewall layers |
| Reverse proxy opens but apps fail | WebSockets, Base URL, TLS, or Known Proxies is configured incorrectly | Use the full client URL, allow WebSockets, and add only the proxy address to Known Proxies |
| Remote access stops when VPN connects | The VPN changed the public route but did not provide an incoming port | Split-tunnel Jellyfin outside the VPN or use the VPN-assigned port with a local redirect |
| Login works but playback buffers | Insufficient upload, transcoding limits, or the VPN/proxy path is slow | Measure home upload, lower remote bitrate, and watch the server dashboard for transcoding |
| Phone works but TV cannot connect | The TV lacks the private VPN client or rejects the certificate/address format | Use a trusted HTTPS domain or a subnet-router design instead of a client-only VPN address |
Jellyfin Remote Access Behind CGNAT
If the router WAN address differs from your public IPv4 or falls inside 100.64.0.0/10, the ISP is probably sharing an upstream address. Your router does not control that upstream translation, so adding more 8096 rules cannot make it reachable.
Jellyfin Remote Access Security
- Use a trusted HTTPS certificate for any public URL; do not publish plain HTTP credentials and streams.
- Expose only the proxy or single required TCP port. Never publish discovery UDP 7359 or a broad port range.
- Give every viewer a separate strong account, disable remote access for users who do not need it, and remove inactive users.
- Keep Jellyfin, the host OS, containers, proxy, and VPN software updated; public services are continuously scanned.
- Protect reverse-proxy logs because Jellyfin can place authentication information in request URLs, and configure Known Proxies precisely.
Remote Streaming Performance
- Your home upload speed is the ceiling for every remote stream combined.
- Direct Play uses less server CPU; incompatible video, audio, subtitles, or bitrate can trigger transcoding.
- A distant VPN or VPS adds latency and may limit throughput, so select a location close to the server and viewers.
- Test an actual title on cellular data at the intended remote bitrate, not just the sign-in page.
Continue With the Right Network Check
Jellyfin Remote Access FAQ
How do you access Jellyfin remotely?
Enable remote connections in Jellyfin, then create a reachable path with Tailscale, an HTTPS reverse proxy, direct TCP forwarding, a VPS tunnel, or a VPN that supplies an incoming port. Add that path's address to the remote client and test outside your Wi-Fi.
Is Jellyfin free for remote access?
Yes. Jellyfin does not charge for remote streaming. Optional infrastructure such as a domain, VPS, VPN, or public-IP service may have its own cost.
How do I enable remote access in Jellyfin?
Open the administrator dashboard, go to Networking > Remote Access Settings, and allow remote connections. Then confirm each permitted user has Allow remote connections to this server enabled. These settings grant permission but do not create the network route.
What port does Jellyfin Remote Access use?
Jellyfin uses TCP 8096 for HTTP and TCP 8920 for its optional native HTTPS service. A reverse proxy commonly publishes TCP 80 and 443. UDP 7359 is local discovery only and should not be forwarded to the internet.
Can I use Jellyfin Remote Access without port forwarding?
Yes. Tailscale or another private mesh VPN creates an outbound path without router forwarding. A VPS tunnel can also publish a normal HTTPS URL, but it requires more administration.
How do I use Tailscale for Jellyfin Remote Access?
Install Tailscale on the Jellyfin server and client, join both to the same tailnet, find the server's 100.x Tailscale address, and add http://that-address:8096 to the Jellyfin client. No public IP is required.
Do I need a VPN for Jellyfin?
No VPN is needed for local playback. For remote access, Tailscale is convenient for private devices. A commercial VPN is useful only when it explicitly provides an incoming port and you route that port to Jellyfin.
Is a reverse proxy the best way to share Jellyfin with family?
It is usually the most compatible option because viewers use a normal trusted HTTPS URL. It also requires a domain, TLS, DNS, a reachable public path, WebSocket support, and correct Known Proxies settings.
Does Jellyfin Remote Access work behind CGNAT?
Not with a router port rule alone. Use Tailscale, request public addressing from the ISP, connect an HTTPS proxy through an outbound VPS tunnel, or use a VPN service that assigns an incoming port.
Is Jellyfin Remote Access safe?
It can be operated safely when you use private access or trusted HTTPS, expose only the required service, keep every layer updated, restrict remote users, protect logs, and avoid publishing the default HTTP port directly to the internet.
Official and Technical Sources
Port, permission, Tailscale, reverse-proxy, HTTPS, and shared-address details in this guide are based on Jellyfin documentation and the Internet Engineering Task Force specification for CGNAT address space.