What’s your go too (secure) method for casting over the internet with a Jellyfin server.
I’m wondering what to use and I’m pretty beginner at this
this post was submitted on 26 Jun 2025
483 points (97.8% liked)
Selfhosted
60177 readers
932 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I’ve look a little on it, didn’t understand most of it. I’m looking for a comprehensive beginner guide before going foward
This isn't a guide, but any reverse proxy allows you to limit open ports on your network (router) by using subdomains (thisPart.website.com) to route connections to an internal port.
So you setup a rev proxy for jellyfin.website.com that points to the port that jf wants to use. So when someone connects to the subdomain, the reverse proxy is hit, and it reads your configuration for that subdomain, and since it's now connected to your internal network (via the proxy) it is routed to the port, and jf "just works".
There's an ssl cert involved but that's the basic understanding. Then you can add Some Other Services at whatever.website.com and rinse and repeat. Now you can host multiple services, without exposing the open ports directly, and it's easy for users as there is nothing "confusing" like port numbers, IP addresses, etc.
So I’m another newbie dummy to reverse proxies. I’ve got my jellyfin accessible at jellyfin.mydomain.com but I can only access it through the web. How do I share with other people who want to use the apps? I can’t get my apps to find my instance.
Can "your apps" access it when their device isn't on your home LAN?
That was the problem, I couldn't access anything away from my LAN. I finally figured it out though. I'm using Pangolin to access my services outside of my LAN and by default it adds a SSO option. Once I turned that off, my iPhone app was able to find my server through my domain name just fine. Thanks!
Do note that without that layer you were using Pangolin for, your system might be compromised by a vulnerability in Jellyfin's server or a brute force attack on your Jellyfin admin account.
Understood. I set a strong password and a max login attempt on my account.
If someone does get into my account, wouldn’t they only be able to watch what I have on my server anyway?
You're trusting Jellyfin to not have some form of privilege escalation attack available. I'm not saying they do have one or that anyone's exploiting it in the field, but yeah. Also if your Jellyfin admin account is allowed to download subtitles to content folders, a "just fuck shit up" style vandal-hacker could delete your media probably. If you mount the media read-only that wouldn't be a concern.
Gotcha. Jellyfin is my backup server behind plex so I’ll just keep it shut off unless I’m using it and set all security things I can within jellyfin when I am using it.
How likely is it someone even finds my server and domain?
you're not particularly worried about "someone", you're worried about bots that are scanning IP ranges and especially default ports. A lot of people will install a program, not really understand what it does, and forward a port because the setup told them to. Then proceed to never update the program (or it's a poorly secured program in the first place).