Access Jellyfin safely from outside home

The tempting shortcut for watching your library away from home is to forward a port on your router straight to the Jellyfin server. It works, and it’s also the thing I’d steer you away from: it puts a media application, listening on a plain port, directly on the public internet, with its login as the only thing between a stranger and your server. There are two better paths, and which one fits depends on who needs access.

If it’s genuinely just you and your household, the cleanest answer is not to expose Jellyfin publicly at all — reach it over a VPN like Tailscale. Every device that’s signed in sees the server by its normal local address, encrypted end to end, with nothing open to the wider internet. It’s the smallest possible attack surface, and for a personal media server it’s usually all you need.

If you want a proper public URL — say, so someone who won’t fuss with a VPN client can watch — then put Jellyfin behind a reverse proxy on its own subdomain, something like watch.example.com, with HTTPS handled by the proxy. That way the only things facing the internet are the standard web ports and a hardened proxy, not the media app itself, and you get a clean name with a valid certificate instead of an IP and a port number.

That trusted-proxies step is the whole reason this question is worth its own answer. The networking is standard reverse-proxy work, but Jellyfin specifically needs to be told which upstream address to trust so it correctly reads the real client behind the proxy. Set it, and remote access behaves exactly like local. Skip it, and you’ll be convinced something deeper is wrong when it’s really just one line of configuration.

So: a VPN if only your people need in, a reverse proxy on a subdomain if you want a shareable public link, and either way, do not port-forward the app directly. Whichever you choose, keep Jellyfin updated — a public-facing media server is exactly the kind of thing worth patching promptly.