The basic setup: port forwarding and reverse proxies

To watch your Jellyfin library from outside your home network, you need to create a path from the internet to your server. The two main approaches are port forwarding through your router and reverse proxies that sit between you and your server.

Port forwarding tells your router to send traffic arriving on a specific port directly to your Jellyfin server's local address. A reverse proxy is software that accepts incoming requests and passes them to your server, then sends the response back to you. Reverse proxies add a layer of security because your server's real address stays hidden from the internet.

Most people start with port forwarding because it requires fewer moving parts. But if you want to avoid exposing your home IP address or you have multiple services running, a reverse proxy becomes the better choice.

Key Takeaways

  • Port forwarding sends internet traffic to your Jellyfin server through your router, but exposes your home IP address to anyone who connects.
  • Reverse proxies like Nginx or Caddy hide your home IP and let you run multiple services on the same port, but require more setup.
  • A dynamic DNS service keeps your connection working even if your internet provider changes your IP address, which happens regularly for most home connections.
  • HTTPS encryption protects your login credentials and library data while in transit, and most reverse proxies can set it up automatically.
  • Jellyfin's built-in remote access feature can work for casual use, but offers fewer security options than port forwarding or a reverse proxy.

Port forwarding: the simplest path

To set up port forwarding, log into your router's admin panel (usually at 192.168.1.1 or 192.168.0.1, with a username and password on the router itself). Find the port forwarding section—the exact location varies by router brand, but it is typically under Advanced Settings, NAT, or Port Mapping.

Create a new forwarding rule that sends traffic on an external port (pick something above 8000, like 8920) to your Jellyfin server's local IP address (something like 192.168.1.50) on port 8096, which is Jellyfin's default port. Save the rule and restart your router if prompted.

From outside your network, you will connect using your public IP address followed by the port number: http://YOUR.PUBLIC.IP:8920. You can find your public IP by searching "what is my IP" in any browser.

The main drawback is that your public IP address is now visible to anyone who connects. If someone discovers your Jellyfin server, they know where to find it. You also need to update your connection address every time your internet provider assigns you a new IP, which can happen without warning.

Dynamic DNS: keeping your address stable

Your internet provider regularly changes your public IP address, sometimes without notice. Dynamic DNS solves this by giving you a permanent domain name that automatically updates whenever your IP changes.

Services like DuckDNS, No-IP, and Dynu offer free dynamic DNS. You create an account, pick a subdomain (like yourname.duckdns.org), and install a small client on your Jellyfin server or router. The client checks your public IP every few minutes and updates the DNS record if it has changed.

Once set up, you connect to your Jellyfin server using the domain name instead of the IP address: http://yourname.duckdns.org:8920. If your IP changes, the domain automatically points to the new address within minutes.

Most routers have built-in dynamic DNS support. Check your router's settings for DDNS or Dynamic DNS, enter your service credentials, and the router handles updates automatically. If your router does not support it, you can run the dynamic DNS client directly on the machine hosting Jellyfin.

Reverse proxies: hiding your server and adding HTTPS

Nginx and Caddy are reverse proxies that accept incoming requests, forward them to your Jellyfin server, and send responses back to the client. They sit between the internet and your server, so your server's real address stays private.

Caddy is simpler for beginners because it handles HTTPS certificates automatically. Install Caddy on the same machine as Jellyfin or on a separate machine on your network, then create a configuration file that tells it to forward traffic from your domain to your Jellyfin server. Caddy handles the rest, including renewing your SSL certificate every 90 days.

Nginx requires more manual configuration but offers finer control. You write a configuration file that specifies how to handle incoming requests, then reload Nginx to explore the changes. Both require you to point your domain name to your public IP address using DNS settings at your domain registrar.

The advantage is that your Jellyfin server never directly touches the internet. Caddy or Nginx handles all incoming connections, validates requests, and can block suspicious traffic before it reaches your server. You also get HTTPS encryption by default, which protects your login credentials and library data in transit.

HTTPS encryption: protecting your data in transit

HTTPS encrypts the connection between your device and your server, so your login credentials and the content you stream cannot be read by anyone intercepting the traffic. Without HTTPS, your password travels in plain text across the internet.

If you use a reverse proxy like Caddy, HTTPS is automatic. Caddy obtains a free certificate from Let's Encrypt and renews it automatically. If you use port forwarding alone, you can still add HTTPS by installing a certificate on your Jellyfin server, though this requires more manual work.

The certificate is tied to a domain name, not an IP address. This is why dynamic DNS or a reverse proxy becomes important: you need a stable domain name to get a valid certificate. Once installed, connecting to https://yourname.duckdns.org:8920 encrypts your traffic automatically.

Jellyfin's built-in remote access feature

Jellyfin includes a built-in remote access option that does not require port forwarding or a reverse proxy. In the Jellyfin admin dashboard, go to Networking and enable Remote Access. Jellyfin will attempt to detect your public IP and port automatically.

This feature works for casual use and requires almost no setup. However, it offers limited security options compared to port forwarding or a reverse proxy. You cannot customize which port is used, and you have less control over how traffic is routed. For a personal library with a few users, it may be sufficient. For anything more serious, port forwarding or a reverse proxy is the better choice.

Choosing between the three approaches

Use Jellyfin's built-in remote access if you want the fastest setup with minimal configuration and you trust Jellyfin's default security settings. It works well for testing or a small household.

Use port forwarding with dynamic DNS if you want direct control over your connection and do not mind your public IP being visible. Add HTTPS by installing a certificate on your Jellyfin server for better security. This approach is straightforward once your router is configured.

Use a reverse proxy like Caddy if you want the strongest security, plan to run multiple services, or want HTTPS without manual certificate management. It requires more initial setup but gives you the most flexibility and protection long-term.

Common problems and how to fix them

Connection times out or refuses to connect: Check that port forwarding is enabled in your router and pointing to the correct local IP address. Verify that your Jellyfin server is running and listening on port 8096. If you are using a dynamic DNS domain, wait a few minutes for the DNS record to update after your IP changes.

Connection works from home but not from outside: Your router may be blocking loopback connections. Try connecting using your public IP or domain name from outside your network, not from inside. Some routers prevent internal devices from connecting to external addresses that point back to the same network.

HTTPS certificate errors: The certificate domain must match the address you are connecting to. If your certificate is for yourname.duckdns.org, connect to that exact address, not an IP address. If you just created the certificate, wait a few minutes for it to propagate.

Jellyfin says remote access is unavailable: This usually means Jellyfin cannot detect your public IP automatically. Disable the built-in remote access and use port forwarding or a reverse proxy instead, which give you explicit control.

Frequently Asked Questions

Is it safe to expose Jellyfin to the internet?

Yes, if you use HTTPS encryption and a strong password. A reverse proxy adds another layer of protection by hiding your server's real address. Keep Jellyfin updated, use a unique password, and consider limiting remote access to specific users rather than enabling it for everyone.

What port should I use for port forwarding?

Use any port above 1024 that is not already in use. Common choices are 8920, 8921, or 9920. Avoid well-known ports like 80 (HTTP) or 443 (HTTPS) unless you are running a reverse proxy that handles traffic on those ports. Check your router's manual to see which ports are reserved.

Can I use Jellyfin remote access and port forwarding at the same time?

Yes, but there is no benefit. Disable Jellyfin's built-in remote access if you are using port forwarding or a reverse proxy. Having both enabled can cause confusion about which connection method is actually working.

Do I need a paid domain name or can I use dynamic DNS?

Dynamic DNS is free and works perfectly for personal use. Services like DuckDNS give you a subdomain at no cost. A paid domain name is optional and only necessary if you want a custom address like mymovies.com instead of mymovies.duckdns.org.

What happens if my internet goes down?

Your Jellyfin server becomes unreachable from outside your network until your connection is restored. There is no way around this—remote access requires an active internet connection. If you need constant availability, you would need to host Jellyfin on a server outside your home, which is a different setup entirely.