When I see this sort of thing, and other people are trying to do it, a reverse proxy or vpn is always mentioned. Heres my question:

How Dangerous is it to just open the port for it on my router and access it like that?

Lets say i want to access jellyfin from Kodi on my xbox or something outside my network, the vpn solution wouldnt work for this i would think.

My issue with reverse proxies, and why im asking, is it seems less secure? I mean Im well aware that an IP is easy to get, i guess. But how likely is someone to look for something on my network specifically? With reverse proxies it seems like i would be broadcasting my server to the internet in a way its easier to happen across, than someone being interested in a random residential IP.

I run a minecraft server for friends on my main computer anyway, and i know tons of people do that, theoretically thats the same level of danger as opening my network for jellyfin specifically.

VPN isnt an option because of this xbox stuff i mentioned and people in my family who have 0 chance of understanding it regardless.

So what is the better option, going through this reverse proxy ( which im actually also unsure would work with kodi) or rawdog the server on my network. I guess leaving the server exposed? or every device even.

  • Danny M ( dannym@lemmy.escapebigtech.info ) 
    6·
    3 years ago

    Look into setting up mesh networks. Opening up a port will work, but it’s insecure, while tools like netbird or tailscale still allow you connect to it remotely, but only allow YOU and the people YOU want to allow to connect to it, not the entire world

  • eddie ( eddie@fig.systems ) English
    3·
    3 years ago

    So the reason you’d want a reverse proxy is because it handles security and would do a much better job of it than an exposed jellyfin port.

    Public FQDN -> your home IP -> your router allows 443/whatever to your reverse proxy -> it handles SSL and being hit by the internet (look into nginx security and even fail2ban) -> proxy serves up whatever insecure site/app you’d like.

      • eddie ( eddie@fig.systems ) English
        3·
        3 years ago

        That’s where nginx security options and other tools like fail2ban come into play. I could’ve mentioned it better in my first sentence but a reverse proxy gives the capability to make it more secure than any options jellyfin will give you.

        I’d rather put nginx with modsecurity in front of jellyfin than not.

  • jason ( jason@sh.itjust.works ) English
    3·
    3 years ago

    I use a reverse proxy so I can just use a hostname and not need a port. I run Jellyfin that way no problem, function-wise.

    Additionally, not having a domain won’t necessarily protect you since you do have people out there scanning for ports and when they see 8096, they’re going to immediately know it’s a Jellyfin/Emby server and any vulnerabilities associated with those. If you use a reverse proxy, they only see 443 which is…pretty much every other site on the internet. That’s security through obscurity, I know, but it will help mitigate some of the easier attacks.

    I’ll say that everything I have to have a port open for (mostly game servers) gets targeted by the internet at large despite the fact that I’ve published the address and port absolutely nowhere online and only shared it with close friends. I almost never get anyone trying to log in to my other services.

  • macgregor ( macgregor@lemmy.world ) English
    2·
    3 years ago

    So I have jellyfin deployed to my kubernetes home lab, router port forwarded to the ingress controller (essentially a reverse proxy) on the cluster. So exposed to the internet. Everything on it has authentication, either built in to the application or using an oauth proxy. All applications also have valid SSL configurations thanks to the reverse proxy. I also use cloudflare DNS with their proxy enabled to access it and have firewall rules to drop traffic that hits port 80/443 that doesn’t originate from those cloudflare proxy ips (required some scripting to automate). It drops a lot of traffic every day. I have other secuirty measures in place as well, but those are the big ones.

    So yeah, if you expose your router to the internet, its gonna get pinged a lot by bots and someone might try to get in. Using a VPN is a very simple way to do this securely without exposing yourself and I’d suggest going that route unless you know what you’re doing.

    • Frylock ( Frylock@sh.itjust.works ) OPEnglish
      2·
      3 years ago

      Tailscale is a vpn no? Dont think i would be able to connect to it from an xbox or, my family who is even less technologically inclined than I am would be able to figure it out on other devices.

    • pbjamm ( pbjamm@beehaw.org ) English
      1·
      3 years ago

      Same idea, but I use Zerotier for providing access to services my remote users need to access at the office. It is idiot proof once set up. This will work fine for computers/tablets/phones but I do not know about an Xbox.

  • pineapplelover ( pineapplelover@infosec.pub ) English
    1·
    3 years ago

    I went about this in a pretty noob way. Synology + Jellyfin and I followed some online guides. Synology gives you a free DDNS hostname so you can access your NAS away from home. I don’t have to VPN or anything. I have to warn that using this method will result in having slow transfer speeds if you’re uploading large files. I use it to stream movies and shows so it seems to be fine for this purpose.