Plex Port Forwarding: Remote Access Setup Guide
Map a public TCP port to your Plex server at internal port 32400, enter the same public port in Plex Remote Access, and fix relay, Double NAT, or CGNAT issues.
Quick Answer
Give the Plex server a stable LAN IPv4 address. In the router, forward one external TCP port, usually 32400, to that server's internal TCP port 32400. In Plex Web App, open Settings > Server > Remote Access, enable Manually specify public port, enter the external port from the router rule, and retry Remote Access. The internal destination stays 32400 even when you choose a different public port. Test from a device outside the home network and confirm the connection is Direct rather than Relay.
Blocked by CGNAT? Compare remote-access VPN optionsPlan Your Plex Router Rule
Enter the Plex server's reserved LAN address and the public port you want to expose. The planner creates a field-by-field reference while preserving Plex's fixed internal port.
Using a different high public port can reduce background scans, but it is not a security boundary. Plex still listens internally on TCP 32400.
Reference only: enter these values manually in the router, application, or VPN client. Copying them does not import or apply the settings.
Plex Port Forwarding Settings at a Glance
Plex uses a fixed private-side port but allows a different public-side port. Keeping those two values distinct prevents the most common manual Remote Access mistake.
| Setting | What to enter | Why it matters |
|---|---|---|
| Internal destination port | 32400 | The router must deliver traffic to TCP 32400 on the Plex Media Server, even when the public port is different. |
| Protocol | TCP | Plex manual Remote Access port forwarding uses TCP. A duplicate UDP rule is unnecessary for this mapping. |
| External / public port | 32400 or a custom port | The public port can be 32400 or another available value. It maps to internal 32400 on the server. |
| Manually specify public port | Same as external port | Enter the router rule's public-side port here, not automatically 32400 when a custom external port is used. |
How to Set Up Plex Port Forwarding
The router brand may label the rule Port Forwarding, Virtual Server, NAT Rule, or Destination NAT. The field values remain the same on UniFi, Asus, Netgear, AT&T gateways, pfSense, OPNsense, Synology routers, and most other platforms.
Give the Plex server a stable LAN address
Create a DHCP reservation in the router for the computer or NAS running Plex Media Server. Confirm the current LAN IPv4 address and reserve that device, so the forwarding rule does not point to another host later.
Open the router's port forwarding page
Sign in to the router or gateway that owns your public IPv4 address. Find Port Forwarding, NAT, Virtual Server, Firewall, or Advanced settings. If another router sits upstream, identify that before creating the rule.
Map the public TCP port to internal 32400
Create a TCP rule with external port 32400 or your chosen custom port. Set the destination to the Plex server's reserved LAN IPv4 address and set the internal or private port to 32400. Save and apply the rule.
Open Plex Remote Access settings
Open Plex Web App while signed in as the server owner. Go to Settings, select the server, open Remote Access, and expand the advanced settings if the manual port option is hidden.
Enter the external port in Plex
Enable Manually specify public port and enter the external port from the router rule. If the router maps public 45000 to private 32400, enter 45000 in Plex, not 32400.
Enable or retry Remote Access
Apply the setting and select Retry or Enable Remote Access. Allow a short period for Plex to retest. If the status changes back after briefly showing green, continue with the external test and upstream checks rather than repeatedly toggling it.
Verify a Direct connection from outside
Stream from a phone on cellular data or another external network. Open the playback information and verify the connection says Direct. A working Relay stream proves account connectivity, not successful port forwarding.
Test Plex Remote Access Correctly
Plex can fall back to relay infrastructure, so successful playback alone does not prove the router rule is working.
Keep Plex Media Server running and confirm local playback works before testing the public address.
Use cellular data or a separate internet connection. Disable Wi-Fi on the test phone to avoid a misleading same-network result.
Inspect playback details and look for Direct. Indirect or Relay means the client did not reach the server through the forwarded port.
Compare the router WAN IPv4 with the current public IPv4. A mismatch points to another NAT layer or CGNAT.
Plex Port Forwarding Not Working
Read the router rule from the public side to the private side: public port, protocol, server address, internal 32400, local firewall, and then the upstream network.
| Symptom | Likely cause | What to do |
|---|---|---|
| A custom public port is forwarded to the same custom internal port | The router sends traffic to a port where Plex Media Server is not listening. | Keep the chosen external port, but change the internal destination port to TCP 32400 on the Plex server. |
| The router rule looks right but Plex shows unavailable | The manual public-port field does not match the router's external port. | Enter the public-side port exactly in Manually specify public port, save, and retry Remote Access. |
| Port 32400 works locally but not from outside | The server firewall or security software blocks inbound TCP 32400 from the LAN interface. | Allow Plex Media Server or TCP 32400 on the active private network profile, then restart the server service. |
| Remote Access stopped after a router or server restart | The Plex server received a new LAN address and the router rule still targets the old one. | Create a DHCP reservation, update the rule to the current server IPv4, and remove duplicate stale rules. |
| The router WAN address is private | An ISP gateway or second router performs NAT before the router containing the Plex rule. | Use bridge or passthrough mode, make one device the only router, or forward the same public port through both NAT layers. |
| The WAN and public IPv4 addresses do not match | The ISP may use CGNAT, so no local router rule can receive unsolicited public IPv4 traffic. | Ask the ISP for public IPv4, use Plex Relay with its limitations, or use a tunnel or VPN setup that explicitly supports an incoming port and Plex routing. |
| Remote playback works but says Indirect or Relay | The client reaches Plex through relay infrastructure instead of a direct inbound path. | Recheck the public-to-private port mapping, manual public port, firewall, and upstream NAT. Test again from outside after each change. |
Plex Remote Access with Double NAT or CGNAT
A correct TCP mapping cannot cross a NAT layer you do not control. If the router WAN address is private, an ISP gateway or another router is upstream. If it is in 100.64.0.0/10 or differs from the public IPv4 shown by NAT Checker, the ISP may be using CGNAT. Bridge or passthrough mode can remove local Double NAT; only the ISP, a public-address service, or an appropriate tunnel can bypass CGNAT.
Can a VPN Provide Plex Remote Access?
A VPN is useful only when it explicitly supplies an incoming port and the Plex server can accept that tunneled connection. The provider's public port may differ from 32400; where the setup allows mapping, route that public port to local TCP 32400 and enter the public value in Plex Remote Access.
Many consumer VPNs block unsolicited incoming traffic, and some forwarded-port features are designed for one local application rather than a LAN service. Confirm server-device support, port persistence, routing, and remote-access behavior before relying on a VPN for Plex.
PureVPN
A possible option when its port-forwarding feature supports the Plex server platform and you cannot obtain public IPv4 from the ISP.
Check availabilityPrivate Internet Access
Provides assigned ports in supported regions. Confirm that your server platform and routing can deliver that assigned port to Plex TCP 32400.
Check availabilityProton VPN
Offers port forwarding on eligible plans and platforms. Verify that the active assigned port can be used for the Plex server process.
Check availabilityIs Plex Port Forwarding Safe?
- Forward one TCP port only. Do not add UDP or broad ranges when the goal is standard Plex Remote Access.
- A custom external port can reduce routine scans but does not replace authentication, updates, or a narrow firewall policy.
- Keep Plex Media Server, the host operating system, router firmware, and NAS packages updated.
- Use a strong unique Plex account password, enable multi-factor authentication, review authorized devices, and remove old shares.
Plex Port Forwarding FAQ
What port should I forward for Plex?
Forward one external TCP port to internal TCP port 32400 on the Plex Media Server. The external port can also be 32400 or another valid available port.
Is Plex port forwarding TCP or UDP?
Manual Plex Remote Access port forwarding uses TCP. Forwarding UDP on 32400 is not required for this public-to-server mapping.
Can the Plex external port be different from 32400?
Yes. Map the custom external port to internal 32400, then enter that same custom external value in Plex's Manually specify public port field.
Is Plex port forwarding safe?
It can be managed safely when you expose one TCP port, keep Plex and the host updated, use strong account security, and avoid DMZ or broad port ranges. Any public service still requires ongoing maintenance.
Why is Plex port forwarding not working?
Check that the router maps the chosen external TCP port to the server's current LAN address at internal 32400, that Plex uses the same public port, and that firewall, Double NAT, or CGNAT is not blocking the path.
What values should I use for Plex port forwarding on UniFi?
Create an Internet or WAN inbound port-forward rule with TCP, your chosen public port, the Plex server's reserved LAN address, and destination port 32400. Enter the public port in Plex Remote Access.
Can Plex Remote Access work without port forwarding?
Plex can use Relay when direct access is unavailable, but relay connections can have bandwidth and quality limitations. UPnP may also create an automatic mapping, though a manual rule is easier to diagnose and keep stable.
What is the difference between Plex Direct and Relay access?
Direct means the remote client reaches your server without Plex Relay carrying the media path. Relay is a fallback when direct connectivity fails and may limit available streaming quality or bandwidth.
Official and Technical Sources
These sources document Plex Remote Access, direct-connect troubleshooting, firewall rules, and the IPv4 shared-address range used when identifying CGNAT.