Does Jellyfin have Remote Access?

[TheDreadPirate]

Does your ISP use CGNAT?

[gizmomelb]

it's not the safest but having port forwarding on your router to your server with jellyfin should just work (make sure your jellyfin server is set to a static ip on your lan).

check your router that it is port forwarding port 8096 (TCP and UDP worked for me when I just tried it) to the IP of the jellyfin server on your LAN.
also make sure the forwarding rule is set to enabled and uses the correct interface (ETH - not VDSL or others) or it won't work.
try to connect to your server using a mobile device to test if it works (diable wifi on the mobile device so it's using 4G/5G)
also it helps if you have a static WAN IP from your ISP - or you'll need to set up some dynamic DNS so external devices can still connect to you when your ISP changes your WAN IP.

[Luftwaffle]

Tailscale is mostly for convenience, it will very likely work (I haven't tried it myself) but again, you're tying yourself to a third party.
I am in the process of setting up remote access to my server and will report back how that worked. It does involve port forwarding.

[nanouk76]

I personally use Caddy as a reverse proxy. Simple. Safe. Renews https certificates automatically. You only need to allow port 443 through to the caddy machine on your router. That will redirect packets to the relevant server on your lan. Works on windows too. For that solution to work you will need to have a registered domain name pointing to tour public router IP. Either you buy one (cheaply) or you use the free services of DuckDNS. See the profuse documentation online and on the Jellydin official documentation. See here. 
As a starter this is the only thing that is needed in my Caddyfile (yes, that is a capitac C) to remotely access the server:

Code:

yourdomain.name {
        reverse_proxy 127.0.0.1:8096
    }

[Luftwaffle]

Ok, so after spending several nights trying to get my own Jellyfin server onto the 'interweb', here's my tuppence worth of thoughts:

1. Plex and Jellyfin employ totally different methods of connecting to remote viewers: as mentioned elsewhere, Plex (the app) uses a central server run by Plex (the company) and any client always connects to that central server first.

2. Theoretically you are correct: you should be able to open port 8096 on your router and redirect incoming traffic to the machine on your local network that runs the jellyfin server. Just keep in mind that you are opening a door to the wild west and any and every crook in the world is sitting just outside your router. (You also need to tell Jellyfin to allow remote access in the settings).

3. There are several levels of security and the VPN option is certainly one of the best, but do you want to explain to your 80 year old aunt Lydia in Timbuktu how to VPN into your server? Believe me, you don't.

4. As everything in life, a compromise is the best option: I decided to go for Caddy and it seems to be working quite well. Aunt Lydia is quite apt to key in 'jellyfin.myserver.com' in a web browser or one of the many Jellyfin clients available for smart TVs.

5. So what do you actually need?

  5.1 A domain name. Either get one from a free service like noip.com or dynv6.com. You choose a subdomain of theirs (mysplendidname.noip.com). Alternatively you can register your own domain. Not as complicated as it sounds. Costs about $15/pa and it's yours (like a personalised numberplate). Note that there are ISPs that offer free ddns service if you purchase the domain from them (mine does). So you got two birds with one stone.

  5.2 A helper programm on your machine that periodically checks your external IP and tells the ISP when it has changed (thus tying your dynamic IP to your superduperdomain.com). I use ddns-updater.

  5.3 Caddy. I am very impressed how simple and easy it is to set up:
      you literally have two lines in the config:
      mysuperduperdomain.com {
        reverse_proxy localhost:8096
      }

      Once you fire up Caddy, it will connect to Let's Encrypt and obtain a certificate for your domain. Automatically and free of charge. It will also renew it every 60 days. Quite impressive.

That's it! (well, besides of Jellyfin, but I guess you're already running that)

Interesting note (which I have not found mentioned anywhere!) DO NOT FORWARD port 8096!
You only forward port 80 (http) and 443 (https) form your router to Caddy. Caddy will direct incoming traffic onto port 8096 (where hopefully Jellyfin is listening).

Finally, in the Jellyfin settings you need to tell it a) there is remote traffic coming in and b) it runs via a reverse proxy. You find that in Dashboard/Networking. (Important: DO NOT enable https! Caddy is taking care of that already). Scroll down to Server Address Settings and in the field 'Known Proxies' you enter 'mysuperduperdomain.com'. A bit further down under 'Remote Access Settings' you find the tickbox 'Allow remote connections to this server'. This MUST be ticked for it to work! (Obviously. Duh!)

End of story. Your aunt Lydia can now type in 'mysuperduperdomain.com' and connect. Notice: no port number here either!

Hope this helps.