Android apps can't connect on my server

[drzaltar]

Helle there,

TL;DR: I use a reverse proxy on my Asustor NAS, to be able to access Jellyfin in HTTPS. It works perfectly from an external network, but only on a web browser, alas android apps can't connect anymore.

First of all, a big thumb up to all the people working on Jellyfin, it's a real work of art.

I bought an Asustor NAS to replace my old Synology, on which my Plex server was running. I'd been wanting to try out Jellyfin for a long time, so this was the perfect opportunity.

On my NAS, I used the built-in DDNS to secure my connection, which was easily done via Let's Encrypt. Then I configured a reverse proxy on my NAS to secure my Jellyfin server (it's very easy with Asustor, I don't have the skills to configure NGINX or CADDY). Everything worked very well, and I now I can connect to my server in HTTPS without any problem on any web browser outside my local network.

Unfortunately, it's impossible to connect an Android application (and probably iOs too, I haven't been able to check) as soon as I go through my reverse proxy.

I've read here and elsewhere that other people have had the same problem, and that it was linked to the SSL certificate, but I have absolutely no idea how to fix it on my system (other persons use complicated configuration with command lines and such).

If anyone knows what I could do to make this happen, I would be extremely grateful.

[bitmap]

Can you share what the config looks like in your app? I don't think most of us running RP here are familiar with the infrastructure of Asustor NAS products. Redact your TLD or whatever you think might be sensitive info, but don't go overboard...

[drzaltar]

Hi bitmap, and thank you very much for your quick answer ! Here is the asustor tutorial I used to obtain my Let's Encrypt certificate, worked like a charm, I can access my NAS from everywhere in htpps :

https://www.asustor.com/en/online/Colleg...c=324#hs32

And here's the one I used to make a reverse proxy for my Jellyfin server. Again, working flawlessly on a web browser, but it's a no no with JF android app :

https://www.asustor.com/en-gb/online/Col...c=325#rp33

Since it work in a web browser, I assumed it's a certificate problem, but again, I really suck at those networking shanigans... It was already a pain in the a** for me to get all that thing working in the fisrt place.

If I can provide more infos, just ask.

[bitmap]

I might be wrong, but I don't think the Android app supported TLDs with ports at the end, which might be the problem. Need a little bit to hunt down where I saw that info or a better answer. Been working all day, so might be tomorrow before I get a chance to respond. Or tonight if I'm bored before I head to bed. It's probably ~8 hr time difference for us, so it'll be interesting to see when schedules intersect...

[drzaltar]

Take all the time you want, it's not urgent, it's already very nice of you to answer me. In any case, for the time being everything's working fine in http, and my friends and family can access my server. But eventually I'd like it to be secured in https, including on Android (my mother uses it on her tablet, and the application is easier for her ^^).

As for TLDs with ports, I already know it works on the Android app, the address used so far being of the form "http://mynas.asustor.com:xxxx/jf". And when I go through the reverse proxy it's the same thing but in https and with a different port, of course. And again, it works perfectly on a web browser, so I know the proxy is functional. It's just that damn Android app that's stubborn xD

I read in another post that I need a "fullchain" certificate or something like that, but I have no idea how to get it or how to install it.

Anyway, it's way beyond my skills, which is why after nights of research on the internet I've come to ask for help here. See you soon pal, take care o/

[drzaltar]

A little bump here, still searching a solution to this problem

[DarkDampSquib]

I think i have the same issue as you.
I run a jellyfin server behind traefik and i can't connect from my android tv or my phone when i'm connected to my wifi.
When using mobile data i can connect from my phone without any issues.
Also accessing the web interface via the browser works fine even with wifi.
Once logged into the app everything works also on wifi.
I also tested iOS and webOS which both worked fine.
As a workaround i just use the servers ip to connect which works fine.

[TheDreadPirate]

Hi bitmap, and thank you very much for your quick answer ! Here is the asustor tutorial I used to obtain my Let's Encrypt certificate, worked like a charm, I can access my NAS from everywhere in htpps :

https://www.asustor.com/en/online/Colleg...c=324#hs32

And here's the one I used to make a reverse proxy for my Jellyfin server. Again, working flawlessly on a web browser, but it's a no no with JF android app :

https://www.asustor.com/en-gb/online/Col...c=325#rp33

Since it work in a web browser, I assumed it's a certificate problem, but again, I really suck at those networking shanigans... It was already a pain in the a** for me to get all that thing working in the fisrt place.

If I can provide more infos, just ask.

When you access from a browser, there is no security warning about your cert, correct?  What kind of Android device are you using?  What version of Android?

I think i have the same issue as you.
I run a jellyfin server behind traefik and i can't connect from my android tv or my phone when i'm connected to my wifi.
When using mobile data i can connect from my phone without any issues.
Also accessing the web interface via the browser works fine even with wifi.
Once logged into the app everything works also on wifi.
I also tested iOS and webOS which both worked fine.
As a workaround i just use the servers ip to connect which works fine.

Without know more about your setup its hard to say what is going on.  If your traefik reverse proxy local?  Or hosted outside your home?

[monocle]

I'm found something similar.

Internal to my network, Jellyfin runs on fin.local.domain:8096, that works fine. Downloaded and installed yesterday, using standard "debuntu" method.

Externally I want it to run as https://buildingname.external.domain:4114/

I'm no stranger to networking, and I have a valid (issued today) Let's Encrypt cert (using the DNS challenge method, due to not-standard port).

Nginx reverse proxy configured to listen on port 4114 and forward traffic to localhost:8096

Main building router forwards buildingname.external.domain:4114 to fin.local.domain:4114

curl https://buildingname.external.domain:4114/ works as expected and validates the cert.

On my Android 11 device I have Jellyfin 2.5.3 installed today from F-Droid.

I tried a couple of variations of buildingname.external.domain:4114 and https://buildingname.external.domain:4114 in the app but I kept getting

"Connection could not be established.
Please check the hostname and your network connection."

The culprit I found was the example config has buried in the middle this redirection:

Code:

    location = / {
        return 302 http://$host/web/;
        #return 302 https://$host/web/;
    }

If you simply swap the '#' to flip which line is commented out, it still doesn't work because you need to add the non-standard port to the redirect:

Code:

        return 302 https://$host:4114/web/;

With that it was fixed.

[Catter]

i think i have a similar problem.

i use jellyfin behind nginx.
my tld points to my server and nginx forwards it to jellyfin on the correct port.
this setup works fine on ios, appletv and in the browser. but android fails to connect.
i have no idea what i'm doing wrong. i use a let's encrypt cert for the server which is valid and only a few days old.

my nginx config looks like this:

Code:

worker_processes  1;
events {
    worker_connections  1024;
}
http {
    include  mime.types;
    default_type  application/octet-stream;
    sendfile  on;
    keepalive_timeout  65;
    server {
        listen 443 ssl;
        server_name  MY.TLD;
        ssl_certificate  ../ssl/MY.TLD-crt.pem;
        ssl_certificate_key  ../ssl/MY.TLD-key.pem;
        ssl_session_timeout  5m;
        location / {
            proxy_pass  http://localhost:8096/;
        }
    }
}

i don't have a lot of experience with nginx. maybe someone can point me in the right direction.
thx!