Plex server setup

[Pinkieprime]

I'm learning about getting Plex set up and doing a sort of initial test on my current laptop, I'll be moving on to a custom built NAS soon. But one thing I ran into during setup was Let's Encrypt. I wasn't able to figure it out right then and found that I'm not able to stream outside of my network, and there is no guide to hold my hand through each step of the process, everything I did find assumed I knew how to do step x of this process, like set up my domain to install the cert. I don't. So, I have Plex up and running at home just fine. How do I open it up to devices outside of home? I'm sure I've said it in previous posts, but I need you to talk to me like I'm 4, because I'm still learning all of this.

[Donut417]

8 hours ago, Pinkieprime said:

I'm learning about getting Plex set up and doing a sort of initial test on my current laptop, I'll be moving on to a custom built NAS soon. But one thing I ran into during setup was Let's Encrypt. I wasn't able to figure it out right then and found that I'm not able to stream outside of my network, and there is no guide to hold my hand through each step of the process, everything I did find assumed I knew how to do step x of this process, like set up my domain to install the cert. I don't. So, I have Plex up and running at home just fine. How do I open it up to devices outside of home? I'm sure I've said it in previous posts, but I need you to talk to me like I'm 4, because I'm still learning all of this.

https://support.plex.tv/articles/200931138-troubleshooting-remote-access/?utm_campaign=Plex Apps&utm_medium=Plex Web&utm_source=Plex Apps

 

There is some good info here. But as it stands the reason why no guides exist that hold your hand, is because there are eleventy billon router makers out in the world and in some cases each one has different ways of implementing port forwarding. Then there is the fact of double NAT and CGNAT and other crap that causes issues. 

 

A few bits of info that might help us. How is your network setup? What is the model numbers of the equipment? What kind of internet speeds do you have? You need to figure out the upload rate because thats the one the Plex server will be using to get videos out to the internet. First you need to verify your internet can handle this, before investing tons of time or money in to this endeavor. 

[Jarsky]

Why are you trying to run it on your own domain? If you want to access the Web Player externally you can use https://app.plex.tv which uses Plex's own certificates. 

If you really want to run it on your own domain name without exposing port 32400 publically, I found the easiest way was just to setup an Nginx docker and put it behind a web proxy. SSL is much easier to manage on Nginx/Apache than directly in Plex. I use Lets Encrypt on my Nginx which covers my Plex, and no special setup required in Plex. This allows me to access Plex from anywhere since its on standard port 443 which everyone allows for obvious reasons. 

[Pinkieprime]

3 minutes ago, Jarsky said:

Why are you trying to run it on your own domain? If you want to access the Web Player externally you can use https://app.plex.tv which uses Plex's own certificates. 

If you really want to run it on your own domain name without exposing port 32400 publically, I found the easiest way was just to setup an Nginx docker and put it behind a web proxy. SSL is much easier to manage on Nginx/Apache than directly in Plex. I use Lets Encrypt on my Nginx which covers my Plex, and no special setup required in Plex. This allows me to access Plex from anywhere since its on standard port 443 which everyone allows for obvious reasons. 

the only reason the domain comes up is because during my setup of nginx with let's encrypt, it asked for a domain. unless i missed some step to skip that, i am stuck at this point. 

[Pinkieprime]

4 hours ago, Donut417 said:

https://support.plex.tv/articles/200931138-troubleshooting-remote-access/?utm_campaign=Plex Apps&utm_medium=Plex Web&utm_source=Plex Apps

 

There is some good info here. But as it stands the reason why no guides exist that hold your hand, is because there are eleventy billon router makers out in the world and in some cases each one has different ways of implementing port forwarding. Then there is the fact of double NAT and CGNAT and other crap that causes issues. 

 

A few bits of info that might help us. How is your network setup? What is the model numbers of the equipment? What kind of internet speeds do you have? You need to figure out the upload rate because thats the one the Plex server will be using to get videos out to the internet. First you need to verify your internet can handle this, before investing tons of time or money in to this endeavor. 

im using a zyxel emg3425-q10a fiber router with 1gb internet. the server is on my asus transformer mini laptop for the time being until i build an actual nas. so, im really not too concerned about whether or not i have good enough internet speeds.

[Jarsky]

10 minutes ago, Pinkieprime said:

the only reason the domain comes up is because during my setup of nginx with let's encrypt, it asked for a domain. unless i missed some step to skip that, i am stuck at this point. 

Does using https://app.plex.tv not fill your needs?

[Donut417]

7 minutes ago, Pinkieprime said:

with 1gb internet

Yeah but most people dont have that. Many internet connections have very crappy upload. But you should be fine. It should be as simple as port forwarding your server. And if @Jarskyis right you should be able ot use the link provide. Which is something I did not know. There is a setting in the Plex settings to enable remote viewing. Just click that bad boy on and port forward. 

[Pinkieprime]

Just now, Jarsky said:

Does using https://app.plex.tv not fill your needs?

so, i tried using a plex app on an lg tv that is not on my network, and it couldnt connect. i just want to make sure that i have a secure connection

[Donut417]

1 minute ago, Pinkieprime said:

so, i tried using a plex app on an lg tv that is not on my network, and it couldnt connect. i just want to make sure that i have a secure connection

Did you port forward your server?

[Pinkieprime]

Just now, Donut417 said:

Did you port forward your server?

no. im sure i could figure that out in my router. i dont need ssl encryption?

[Donut417]

Just now, Pinkieprime said:

no. im sure i could figure that out in my router. i dont need ssl encryption?

Port forwarding allows stuff outside of your routers firewall. Be it a Plex server or a game server Port forwarding is the only way to allow remote connections. Keep in mind your router has a firewall to stop nasty things from getting in to your network. 

[Jarsky]

If you're intent on using Nginx and LetsEncrypt. Then what you need to do is

 

1. Setup your Domain with your registrar (wether you configure an A record pointing to your external IP address, or use a DynDNS and install/setup a DynDNS client)

2. Install and configure Nginx

3. Install Certbot

sudo apt install certbot python3-certbot-nginx

4. Create your site

sudo nano /etc/nginx/sites-available/mywebsite.com

5. Create a base configuration inside this file

server {
	server_name mywebsite.com;
}

6. Activate the site

ln -s /etc/nginx/sites-available/mywebsite.com mywebsite.com

7. Test Nginx and if OK then reload it

sudo nginx -t
sudo systemctl reload nginx

8. Test your site works on http://mywebsite.com , if not then check your firewall you have allowed port 80 (and port 443 for the next part)

e.g sudo ufw status

9. Install the Lets Encrypt certificate using Certbot

sudo certbot --nginx -d mywebsite.com

Select to redirect http traffic to https

10. Change your site configuration, to reverse proxy to your Plex Server. Here is my configuration (the error 502 page is a custom thing so can leave that out)

 

#Upstream to Plex
upstream plex_backend {
        server mywebsite.com:32400;
        keepalive 32;
}

server {
        server_name    plex.mywebsite.com;


    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/plex.mywebsite.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/plex.mywebsite.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    send_timeout 100m; #Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause (e.g. Chrome)

        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/nginx/ssl/lets-encrypt-x3-cross-signed.pem;

        #Will ensure https is always used by supported browsers which prevents any server-side http > https redirects, as the browser will internally correct any request                                                                                                                                                     to https.
        #Recommended to submit to your domain to https://hstspreload.org as well.
        #!WARNING! Only enable this if you intend to only serve Plex over https, until this rule expires in your browser it WONT BE POSSIBLE to access Plex via http, rem                                                                                                                                                    ove 'includeSubDomains;' if you only want it to effect your Plex (sub-)domain.
        #This is disabled by default as it could cause issues with some playback devices it's advisable to test it with a small max-age and only enable if you don't enco                                                                                                                                                    unter issues. (Haven't encountered any yet)
        #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

        #Plex has A LOT of javascript, xml and html. This helps a lot, but if it causes playback issues with devices turn it off. (Haven't encountered any yet)
        gzip on;
        gzip_vary on;
        gzip_min_length 1000;
        gzip_proxied any;
        gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml;
        gzip_disable "MSIE [1-6]\.";

        #Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones.
        #Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more
        client_max_body_size 100M;

        #Forward real ip and host to Plex
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        #When using ngx_http_realip_module change $proxy_add_x_forwarded_for to '$http_x_forwarded_for,$realip_remote_addr'
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions;
        proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
        proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;

        #Websockets
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        #Disables compression between Plex and Nginx, required if using sub_filter below.
        #May also improve loading time by a very marginal amount, as nginx will compress anyway.
        #proxy_set_header Accept-Encoding "";

        #Buffering off send to the client as soon as the data is received from Plex.
        proxy_redirect off;
        proxy_buffering off;

        location / {
                #Example of using sub_filter to alter what Plex displays, this disables Plex News.
                #sub_filter ',news,' ',';
                #sub_filter_once on;
                #sub_filter_types text/xml;
                proxy_pass http://plex_backend;

        error_page 502 /502.html;
        location = /502.html {

        root  /var/www/mywebsite;
        }

        }
}
server {
    if ($host = plex.mywebsite.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        server_name    plex.mywebsite.com;
    listen 80;
    return 404; # managed by Certbot


}

11. Again test your Nginx configuration, and reload if all OK

 

sudo nginx -t
sudo systemctl reload nginx

 

[Jarsky]

9 minutes ago, Pinkieprime said:

so, i tried using a plex app on an lg tv that is not on my network, and it couldnt connect. i just want to make sure that i have a secure connection

Lets keep it clear, by default Port 32400 is already using a Cloudflare SSL certificate provided by Plex. 

When you connect externally via an app, it authenticates on plex.tv authentication servers, and then redirects to your Plex instance over port 32400. 

 

You do not need your own certificate to secure traffic, the traffic is already secured by Plex's own certs. They use some wildcard cert magic to secure this all on your behalf. There is little reason to use your own certificate in Plex, and using an Nginx proxy is only for the web app, not for smartphone/tv/roku/etc.. apps. They will be redirected magically via app.plex.tv

[Jarsky]

You need to make sure that https://myipaddress:32400 can be reached externally, if not then apps will not connect either. 

As stated above, make sure that port 32400 is open (or whatever port this is configured as in Plex....32400 is the default) either allowed in the firewall on the server Plex is running on itself, or in your routers firewall. Also make sure you have your port forward configured on your router from the internet to your server. 

 

If its configured properly, then this will say its "Fully accessible outside your network". 

Try also specifying port manually, and enter 32400 and Apply. Its a known bug that sometimes not doing this will stop it from working. 

 

[Pinkieprime]

25 minutes ago, Jarsky said:

Lets keep it clear, by default Port 32400 is already using a Cloudflare SSL certificate provided by Plex. 

When you connect externally via an app, it authenticates on plex.tv authentication servers, and then redirects to your Plex instance over port 32400. 

 

You do not need your own certificate to secure traffic, the traffic is already secured by Plex's own certs. They use some wildcard cert magic to secure this all on your behalf. There is little reason to use your own certificate in Plex, and using an Nginx proxy is only for the web app, not for smartphone/tv/roku/etc.. apps. They will be redirected magically via app.plex.tv

well i wish that was said on the plex website instead of telling me to mess around with let's encrypt! ill just go this route, sounds much easier

[Pinkieprime]

41 minutes ago, Jarsky said:

If you're intent on using Nginx and LetsEncrypt. Then what you need to do is

 

1. Setup your Domain with your registrar (wether you configure an A record pointing to your external IP address, or use a DynDNS and install/setup a DynDNS client)

2. Install and configure Nginx

3. Install Certbot

sudo apt install certbot python3-certbot-nginx

4. Create your site

sudo nano /etc/nginx/sites-available/mywebsite.com

5. Create a base configuration inside this file

server {
	server_name mywebsite.com;
}

6. Activate the site

ln -s /etc/nginx/sites-available/mywebsite.com mywebsite.com

7. Test Nginx and if OK then reload it

sudo nginx -t
sudo systemctl reload nginx

8. Test your site works on http://mywebsite.com , if not then check your firewall you have allowed port 80 (and port 443 for the next part)

e.g sudo ufw status

9. Install the Lets Encrypt certificate using Certbot

sudo certbot --nginx -d mywebsite.com

Select to redirect http traffic to https

10. Change your site configuration, to reverse proxy to your Plex Server. Here is my configuration (the error 502 page is a custom thing so can leave that out)

 

#Upstream to Plex
upstream plex_backend {
        server mywebsite.com:32400;
        keepalive 32;
}

server {
        server_name    plex.mywebsite.com;


    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/plex.mywebsite.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/plex.mywebsite.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    send_timeout 100m; #Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause (e.g. Chrome)

        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/nginx/ssl/lets-encrypt-x3-cross-signed.pem;

        #Will ensure https is always used by supported browsers which prevents any server-side http > https redirects, as the browser will internally correct any request                                                                                                                                                     to https.
        #Recommended to submit to your domain to https://hstspreload.org as well.
        #!WARNING! Only enable this if you intend to only serve Plex over https, until this rule expires in your browser it WONT BE POSSIBLE to access Plex via http, rem                                                                                                                                                    ove 'includeSubDomains;' if you only want it to effect your Plex (sub-)domain.
        #This is disabled by default as it could cause issues with some playback devices it's advisable to test it with a small max-age and only enable if you don't enco                                                                                                                                                    unter issues. (Haven't encountered any yet)
        #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

        #Plex has A LOT of javascript, xml and html. This helps a lot, but if it causes playback issues with devices turn it off. (Haven't encountered any yet)
        gzip on;
        gzip_vary on;
        gzip_min_length 1000;
        gzip_proxied any;
        gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml;
        gzip_disable "MSIE [1-6]\.";

        #Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones.
        #Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more
        client_max_body_size 100M;

        #Forward real ip and host to Plex
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        #When using ngx_http_realip_module change $proxy_add_x_forwarded_for to '$http_x_forwarded_for,$realip_remote_addr'
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions;
        proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
        proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;

        #Websockets
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        #Disables compression between Plex and Nginx, required if using sub_filter below.
        #May also improve loading time by a very marginal amount, as nginx will compress anyway.
        #proxy_set_header Accept-Encoding "";

        #Buffering off send to the client as soon as the data is received from Plex.
        proxy_redirect off;
        proxy_buffering off;

        location / {
                #Example of using sub_filter to alter what Plex displays, this disables Plex News.
                #sub_filter ',news,' ',';
                #sub_filter_once on;
                #sub_filter_types text/xml;
                proxy_pass http://plex_backend;

        error_page 502 /502.html;
        location = /502.html {

        root  /var/www/mywebsite;
        }

        }
}
server {
    if ($host = plex.mywebsite.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        server_name    plex.mywebsite.com;
    listen 80;
    return 404; # managed by Certbot


}

11. Again test your Nginx configuration, and reload if all OK

 

sudo nginx -t
sudo systemctl reload nginx

 

but if i were so inclined to use nginx on a nas running freenas for my plex server, this is the route i can go?

[Jarsky]

1 hour ago, Pinkieprime said:

but if i were so inclined to use nginx on a nas running freenas for my plex server, this is the route i can go?

 

Yeah if you really want to setup your own reverse proxy, this is how to do it. 

But theres no reason to do so for 98% of Plex Users