Android client can't connect over VPN

[baronvonj]

I have setup an OpenVPN server on my router, and am able to connect to other home servers with my phone (android) on mobile data over the VPN connection. My Jellyfin server is on a Synology NAS, deployed via Docker (as close as possible to the documentation here, but I guess it was written with older version of Container Manager as some screens were different). I also have Emby installed on the same NAS. I am able to connect Emby client from my phone over the VPN connection to the NAS Emby server. The Jellyfin client however says it can't connect to the Jellyfin server. When I hit connect it says "Tried 2 candidates for input, without success" and lists the https and http versions of the host:port I entered. I have configured the same set subnet CIDRs as local network in both Emby and Jellyfin. When I try to connect via chrome browser to the ip:port of Jellyfin, it does redirect me to the /web page, but the page content never loads.

[TheDreadPirate]

Are you using a reverse proxy? If so, which one and can you share the config? Censor the domain.

[baronvonj]

I believe the answer is no. I setup an OpenVPN server config on my router, and exported a ovpn config file. I set the VPN server to only allow access in, it does not give internet access back out from the internal network to the VPN clients. I do have a personal domain that my NAS is setup to update DNS with a record pointing home, but the ovpn file is using a hard coded IP, not my personal DNS. I downloaded OpenVPN Connect on my phone and imported the ovpn file. That connected my phone to my home network. I tested connecting to some simple of other the web services I have on my NAS and then the jellyfin client.

[TheDreadPirate]

It just occurred to me. Did you change the port used by Emby or Jellyfin? Jellyfin was forked from Emby and still uses the same ports, 8096 and 8920. If you are running Emby and Jellyfin on host networking and didn't change the ports used, whichever starts first will bind to 8096 and prevent the other from starting.

[baronvonj]

Yeah they're on different ports. They're both working fine from my phone clients while on wifi.

[TheDreadPirate]

Do you have any host firewall rules restricting access from certain IP ranges?

An example from my system.

   

Only local or VPN clients can connect to 8096.  Other IP ranges have to go through Nginx on another port.

Is your VPN subnet allowed to connect to whatever port you have Jellyfin running on in the host's firewall settings?

[baronvonj]

synology firewall is not enabled.

[TheDreadPirate]

I'll do some testing when I get home and get back to you.

[TheDreadPirate]

It just worked for me.

   
   

Can you share your network.xml file and post your full jellyfin log to pastebin?

[baronvonj]

It'll be Sunday evening when I can look again.