Jellyfin Away from Home with Tailscale: A Realistic Guide for the Whole Family

Informatec Digital » Networks » Jellyfin Away from Home with Tailscale: A Realistic Guide for the Whole Family

Jellyfin works like a charm at home: you install the server, add the folders, and in a few minutes your library is available in the living room. The trouble starts when you want to watch something on a phone, iPad, or TV belonging to a relative who's miles away. That's where the router, ports, domains, and a whole host of other decisions come into play, which, for those who don't want to complicate things, can turn a quiet afternoon into a headache. Remote access is a whole other story , and if you want people with limited technological patience to use it, things get even more complicated.

The good news is that there are solutions that avoid opening ports and even work when your ISP has you behind CGNAT. Tailscale is the most popular way to get by without touching the router, but it's not magic: it requires installing something on each device and has clear limitations when it comes to Samsung or LG TVs, or older devices. There's no silver bullet that will turn Jellyfin into Plex for the whole family without any setup, but there are clearer paths than others. Let's go over all the details carefully, including what no one usually talks about regarding Tailscale, Cloudflare Tunnel, VPSs, and Jellyfin's security settings.

Why does Jellyfin get stuck when leaving home?

On a local network, everything is very simple: the server has a private address, something like 192.168.1.50, and any device connected to the same Wi-Fi network can access it without issue. The situation changes when the request comes from the internet, because your router doesn't know which device to forward that traffic to. To solve this, three classic solutions are usually used: port forwarding, setting up a reverse proxy, or using a tunnel like Cloudflare. All three are complex , and none are designed for your mother-in-law to configure from the other side of the world.

Port forwarding involves telling the router that all traffic arriving on a specific port should be routed to the computer running Jellyfin. It sounds easy, but it requires accessing the router's control panel, creating a rule, assigning the server's local IP address, and hoping that the public IP address doesn't change frequently. Furthermore, opening ports on the router creates a vulnerability visible from the internet, and if not properly secured, it can become a significant security hole.

A reverse proxy is more elegant, but also more technical. It's used to receive visits, encrypt the connection with HTTPS, and pass them to the Jellyfin server inside. It usually requires buying or managing a domain, configuring certificates, and understanding what's happening at each step. It's not impossible , but it's not what you'd recommend to someone who just wants to watch a movie on their iPad without calling a computer expert.

Cloudflare Tunnel is another option: you install a program on the server, it opens an outbound connection, and your guests can access it using a normal name without needing to open ports or have a public IP address. The problem is that Cloudflare's fine print isn't as user-friendly as it seems when it comes to serving video, and you also depend on an intermediary who can change the rules or limit your service.

The common denominator of all these options is that, in one way or another, they expose your home network to the internet , publish a domain, or depend on a third-party provider. This explains why many people forgo Jellyfin's remote access feature before getting too complicated. Jellyfin's own recommendation is clear: opening a direct port to the internet is not advisable because passwords can travel unencrypted if you use plain HTTP. Port 8096 is for HTTP , 8920 is intended for HTTPS but is not used by default, and 7359 is for local discovery, so these shouldn't be exposed either.

What does Tailscale offer and where's the catch?

Tailscale builds a private network based on WireGuard. The idea is that you install the application on multiple devices, authorize them with the same account, and they all behave as if they were connected to the same router, even if they are in different countries. There's no need to open ports or have a public IP address , because each device initiates its connection to the Tailscale network and they are all in the middle. For a home server running CGNAT, this is a huge relief.

When you register multiple devices, a tailnet is created, which is the private network associated with your account. Each device receives an address like 100.xyz and a MagicDNS name so you don't have to memorize numbers. This is the address you then enter into the Jellyfin app to connect from outside. Tailscale distributes addresses from the 100.64.0.0/10 block , the same one used for CGNAT, but don't get confused: your router's internet address is something else entirely, and that's what you need to check when verifying if you have CGNAT.

Tailscale's Personal plan is free for non-commercial use and allows up to six users, including yourself, so you can invite five more people. The company describes it as free forever on that plan, and for normal family use, it's usually perfectly adequate. Combined with Jellyfin, which is free and open-source , you have a multimedia ecosystem without paying a subscription, unlike Plex Pass, which charges for remote streaming.

Tailscale is also the recommended option when the operator enforces CGNAT or when the ISP blocks certain incoming connections. Instead of dealing with the router, the server and clients connect to the private network and meet there. CGNAT becomes irrelevant for that connection because you don't need anyone calling your home network from outside.

However, the hidden cost isn't money, it's convenience. Every device that wants to access the content needs Tailscale installed and authorized , and the server has to be powered on and connected to the tailnet for the content to be available. If your mother uses a Samsung TV, your mother-in-law has a Google TV, and your brother hands out old Android tablets, you'll have to install and configure Tailscale on each device or find a bridge. For someone who isn't tech-savvy, that's already a barrier.

Sharing with others also comes with a catch. Tailscale allows machine sharing on all plans, but the guest needs their own account and, furthermore, must be the owner, administrator, or IT manager of their own tailnet to accept the invitation. It's not as simple as sending a link and letting the other person log in without doing anything. For your mother-in-law, that might mean an installation, registration, and a couple of screens before watching the first movie.

Finally, Tailscale doesn't always establish a direct connection between the two endpoints. When there's a hard NAT, firewall, or other limitations, traffic is routed through Tailscale's DERP relays. This can add latency , and it's noticeable in video: one day it's smooth, and the next it stutters even if you haven't changed any settings. Tailscale's acceptable use policy doesn't include a specific clause regarding bandwidth, video, or traffic volume, but that doesn't change the fact that relays are a last resort and not a guarantee of perfect streaming.

Before touching anything: check if you have CGNAT

CGNAT means your internet service provider shares the same public IP address among several customers. You don't have your own address on the internet, and no matter how many ports you open on your router, there's no way for anyone outside your network to access your home. It's a shared public IP address , so traditional port forwarding won't work, no matter how much you configure it.

The check is quick. Access your router's control panel and find its internet IP address, WAN IP, or external IP. Then, from a device connected to the same network, search "What is my IP address?" on Google and compare the two numbers. If they don't match, there's an intermediary. If the WAN IP address is between 100.64.0.0 and 100.127.255.255 , the problem is clear: you're behind CGNAT. A second router in the same chain can also produce the same symptom, so don't rule that out.

If you have CGNAT, before trying any workarounds, it's worth calling your provider and asking if they can give you a public IPv4 address. It depends on your contract and location, and there might be a cost, but it's the only way to restore traditional port forwarding. There's also the option of native IPv6: if your server has a globally routable IPv6 address and the network you're accessing from also uses IPv6, you might be able to connect that way. CGNAT is an IPv4 issue , so don't rule it out before checking.

And beware of shortcuts: a dynamic DNS doesn't fix CGNAT. A name pointing to a shared IP still won't lead to your home. A dynamic DNS doesn't fix a shared IP ; it only updates the name when your public IP changes, so you first need to have a real public IP and then worry about the name.

Riding a Tailscale with Jellyfin without the hassle

The basic process is shorter than choosing what to watch on a Friday night. First, you install Jellyfin on the computer that will act as the server. If it's Windows, it's best to mark it as a service so it starts automatically before you log in. Then, go to http://localhost:8096 , add the folders from your hard drive, and configure the library, subtitles, and playback progress synchronization.

With the server running, install Tailscale on the same computer and on the devices you want to access it from. During the initial setup, create an account and authorize the devices, which generates the tailnet. Use the same account on all devices so they can see each other. If you install Tailscale on the server but not on the mobile device, the mobile device will not be part of the private network and will not be able to access it.

To find the server address within Tailscale, you can use the `tailscale ip -4` command on the server machine or check the application. It will return something like 100.121.112.23. In the Jellyfin client app, manually add the server using that address and the corresponding port, for example, 100.xyz:8096 . Jellyfin's autodiscovery only works on the local network, so from outside the local network, you'll have to manually enter the address.

Tailscale is available for Windows, macOS, Linux, Android, iPhone, Chromebook, Apple TV, and Amazon Fire. The list covers many devices , but not all. Samsung Tizen and LG webOS TVs don't have Tailscale, although they do have the official Jellyfin app. Herein lies the problem: the TV can run Jellyfin, but it remains outside your private network unless something connects it to it.

Remember that the server must remain powered on and connected to the Tailnet. A constantly running server is essential: if the computer shuts down or loses connection, your family members will be without access to the library. You also cannot use Tailscale for commercial purposes with the free plan, so if this is going to be a service for half your family, make sure it meets your personal requirements.

The real problem: TVs and impatient family members.

On a Samsung Tizen or LG webOS TV, Jellyfin has an official app in the store, but Tailscale isn't available. The TV can open Jellyfin, but it's not on the home network, so it doesn't reach the home server. The TV remains outside the home network , and there's no magic setting within the app to fix it.

The technical solution involves setting up a subnet router: a device that does have Tailscale installed and acts as a bridge between the private network and those devices that can't install the application. It works, but it's no longer a simple afternoon of configuration: it involves setting up another device, leaving it powered on, and explaining its inner workings to anyone who needs it. It acts as a bridge , yes, but it's neither transparent nor time-consuming.

With Google TV, Chromecast, and older Android tablets, you have to look at each case individually. If the device allows Tailscale to be installed from its store, you can try it; if not, we're back to the same problem. Each device that wants to connect needs its own installation or a bridge to cover it. In a house with several older tablets, that can be quite a hassle.

Sharing your tailnet with a family member isn't as simple as pressing a button. The guest needs their own account and, moreover, must be the owner or administrator of their own tailnet to accept the invitation. Having their own account and being an administrator is asking too much for someone who just wants to watch a show. For your mother or mother-in-law, that's not comparable to opening Plex and finding the library already set up.

That's why, even if Tailscale is the simplest option for you, it's not the simplest for your family. It's not comparable to Plex in terms of transparency for the end user. If all the devices were yours and you could set them up beforehand, it would be wonderful. But when there are third-party TVs and family members who aren't very tech-savvy, the situation changes.

Alternatives so your family doesn't have to install anything

If your goal is for your guests to turn on the TV and watch Jellyfin without installing Tailscale, the most transparent option is a VPS with a VPN to your home and a reverse proxy. You rent a small server on the internet, which does have a static public IP address, set up a VPN between the VPS and your home, and use a reverse proxy to receive the visits. The guest only sees a normal domain with an HTTPS padlock, without installing anything or registering anywhere. However, this is the most laborious setup and the only one with a recurring bill.

The key is that the call originates from your home network, not the VPS. Your home server opens the connection to the VPS, so CGNAT doesn't interfere. Then, the VPS's reverse proxy receives your family members' visits and sends them through the tunnel to Jellyfin. The call originates from your home network , and the guest only sees a domain with a certificate. However, the VPS doesn't increase your bandwidth: the video still originates from your home network and uses your upload speed.

The bottleneck is your upload speed , not the size of your library. It doesn't matter if you have 30 TB of movies: only what's being played passes through the tunnel. If your connection has less than 100 Mbps upload speed, it's advisable to limit Jellyfin's bitrate to 70% of that speed to avoid interruptions. This limit is configured in the control panel and affects devices outside your local network.

WireGuard is another option if you don't have CGNAT. It's free, fast, and exposes a UDP port instead of the Jellyfin panel, so anyone without the key won't even receive a response. It works perfectly without CGNAT , but with CGNAT, your home server doesn't have a stable address to call, so the listening endpoint has to be off-site: you're back to a VPS. Someone has to be listening outside your home network; there's no way around it.

Cloudflare Tunnel avoids opening ports and doesn't require a public IP address. You install Cloudflare on the server, an outbound connection is established, and your guests access it through their browsers without installing anything. The problem lies in the fine print: Cloudflare's specific terms state that, unless you're an Enterprise customer, you must use paid services to serve video and large files through their CDN. Cloudflare reserves the right to disable or limit access if they suspect you're using the CDN without these services. The old section 2.8 that circulated in the forums was repealed in May 2023, and the word "Tunnel" doesn't appear in that document, so there's neither an explicit prohibition nor a clear authorization. It's a gray area.

If you have a public IP address and just want a name instead of a string of numbers, a free dynamic DNS service will do the trick. DuckDNS advertises itself as free and hosted on AWS, with no credit card required. No-IP maintains a free plan with a hostname and no credit card required. DuckDNS and No-IP are the best-known options, but DynDNS no longer offers a free plan: you'll only see the option to purchase the service or a seven-day trial. And remember that a dynamic DNS service doesn't fix CGNAT or replace port forwarding.

Opening port 8096 to the world is the worst idea ever. Jellyfin says it bluntly: opening a direct port to the internet is insecure and not recommended. If you use HTTP, passwords travel unencrypted. The best approach is to use a reverse proxy to terminate HTTPS, and avoid self-signed certificates because they cause compatibility and security problems. HTTPS termination in a reverse proxy is the sensible way to do it; simply enabling a few settings in Jellyfin and hoping for the best.

Security and settings worth adjusting in Jellyfin

Port 8096 is for HTTP, 8920 is intended for HTTPS but isn't used by default, and 7359 is for local discovery. Port 8096 shouldn't be open to the public as is. If you're going to expose something, have a reverse proxy with HTTPS receive the visits and route the traffic to Jellyfin.

There are two separate switches for remote access: one at the server level, in Networking and Remote Access Settings, and another per user, on each person's profile, with the option "Allow remote connections to this server." Two separate switches mean you can exclude accounts used only at home and allow only those who truly need remote access.

The speed limit is configured in Control Panel > Playback > Streaming, under Internet streaming bitrate limit. It's a limit per stream for all devices outside your network. If your upload speed is less than 100 Mbps, Jellyfin recommends setting it to 70% of your upload speed. Two streams double this limit , so don't think of it as a total limit: it's per stream. You can override the global value in each user's profile.

Quick Connect lets you log in with a temporary six-character code instead of a username and password. It comes enabled by default and can be convenient, but the code isn't valid on its own: it needs to be authorized by a device where you're already logged in. It 's not a magic backdoor. If you don't want it, you can disable it in Settings > Control Panel > General by unchecking "Enable Quick Connect on this server."

For large libraries, don't obsess over disk size. Only the file being played passes through the tunnel, so what matters is the bitrate of that file and your upload speed. The size of the library doesn't affect bandwidth; what matters is the bitrate of the movie or series you're currently watching.

What to choose according to your case

If you're on your own and your devices are a mobile phone, laptop, or tablet, Tailscale is the most straightforward option: one afternoon, zero euros, and CGNAT ceases to exist for you. Tailscale benefits your own devices because you can install and authorize it independently. It's the simplest solution when there are no third-party televisions involved.

If you're going to share with family who watch TV and don't want to install anything, the VPS with VPN and reverse proxy is the only one that gives them a Plex-like experience: they open a domain, enter the password, and watch the content. The only one that doesn't install anything is also the most expensive in terms of time and the only one with a monthly bill. For your mother, your mother-in-law, and the kids with old tablets, that transparency is invaluable.

If you have a public IP address and only want a name instead of a changing IP, use DuckDNS or No-IP. Dynamic DNS is the solution for the name, but not for CGNAT or security. First, verify that your public IP address is yours, and then worry about the name.

Cloudflare Tunnel can be useful if you understand its terms and don't mind relying on a third party. Don't assume it's free with no strings attached : video restrictions exist, and Cloudflare may limit the service. If you try it, do so with full awareness, knowing that there's no official explanation regarding Tunnel traffic in their terms.

What you absolutely shouldn't do is open up port 8096 to the world and rely on luck. Opening port 8096 to the world is the worst option: insecure, exposed, and with passwords that can travel unencrypted. If you don't want to set anything up, use Tailscale for your devices; if you want transparency for your family, use a VPS with a VPN and reverse proxy; if you just need a domain name, use dynamic DNS; and if Cloudflare Tunnel tempts you, read the fine print first.

The final decision depends on who will be using Jellyfin and how much time you're willing to invest. Tailscale is the simplest option for you, but not the most transparent for your family. If all the devices were yours, Tailscale would be nearly perfect. With Samsung, LG, or Google TVs and family members who don't want any hassle, a VPS with VPN and reverse proxy is the closest thing to the Plex experience: they don't install anything, you handle the work and the bill. And if you just want to try it out without spending a penny, Tailscale can get you out of a bind today, provided you can configure each device and accept that the server is always on.