SOLVED: Web page loads but cannot connect to server

[sravoff]

Solution: I was forwarding the client IP via the headers. So even though Apache was a proxy and connecting to Jellyfin via localhost, Jellyfin saw a remote client. I enabled remote connections and it works now. 

The remote connection ports are ignored since Apache forwards the connection to localhost:20001. I didn't think to remote connection section at all because of that.

Original Question:

I have a bare-metal installation of jellyfin via curl -s https://repo.jellyfin.org/install-debuntu.sh | sudo bash, and there seems to be an error or a block between Jellyfin's web page and the media server.

I can load the page with Jellyfin and fill out the server to connect to, but when I press connect I get "Connection Failure We're unable to connect to the selected server right now. Please ensure it is running and try again."

This is from outside my home network. I can access a separate website (site.example.com) on the same ubuntu server, so traffic gets into and out of the server as expected. I'm proxy passing jellyfin.example.com to Jellyfin (http://localhost:20010) on the backend with Apache2. Encryption is handled by Certbot, and looks good for site.example.com.

If I am on my home network, either computer or my phone connected to wifi, I can connect to the Jellyfin server. So there's just some issue with connecting from outside the network to the Jellyfin server.

I have a parallel Emby server with emby.example.com proxy passed to port 20005, and that works fine.

I haven't had any luck finding errors or anything in the logs, any ideas? Is there a way to see if ATT is blocking the server data only somehow?

Here's my http Apache config, the https is handled by certbot and seems fine:

Code:

# This works fine
<VirtualHost *:80>
        ServerName site.example.com
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        DocumentRoot /var/www/site
RewriteEngine on
RewriteCond %{SERVER_NAME} =site.example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

# Emby works, but I'd rather run open-source
#<VirtualHost *:80>
#        ServerName emby.example.com
#        ErrorLog ${APACHE_LOG_DIR}/error.log
#        CustomLog ${APACHE_LOG_DIR}/access.log combined
#        ProxyPass / http://localhost:20005/
#        ProxyPassReverse / http://localhost:20005/
#RewriteEngine on
#RewriteCond %{SERVER_NAME} =emby.example.com
#RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
#</VirtualHost>

# Jellyfin gives the server selection page, but cannot connect to the server
<VirtualHost *:80>
        ServerName jellyfin.example.com
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        ProxyPass / http://localhost:20010/
        ProxyPassReverse / http://localhost:20010/
RewriteEngine on
RewriteCond %{SERVER_NAME} =jellyfin.example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

[TheDreadPirate]

Did you allow remote connections in Jellyfin's settings?

[sravoff]

Did you allow remote connections in Jellyfin's settings?

I did not, but shouldn't the proxy pass connections be local? It works with computers and phones connected to the same network via wifi (the Jellyfin server is wired to the same router). But as soon as I turn wifi off on my phone, it can only load the Jellyfin page to select a server, which then it fails to connect to the server.

When I get on the network, I can go to site.example.com, then add the server with address site.example.com. And it works perfectly. Different computers on the network should still be remote connections right?

[TheDreadPirate]

The proxy passes the original clients IP via the x-forwarded-for header.

As for what is considered "remote", there is a setting that defines what IP's are considered "local". Dashboard > Networking > LAN networks. By default (the field is blank), the following subnets are considered "local".

192.168.0.0/16
10.0.0.0/8
172.17.0.0/16

If your client IP does not belong to any of those subnets, the client is "remote" and you need to "Allow remote connections".

And since Apache forwards the client IP in the header, Jellyfin still sees the original IP and treats it according to what you've defined as local. You can literally put any IP address or subnet in the LAN networks field. If you have an OpenVPN or Tailscale VPN setup, you can configure Jellyfin to treat those VPN IP addresses as "local".

[sravoff]

Thank you!

Yeah, I was missing the understanding of subnets--I've been behind on networking my whole career. I'd overlooked the remote connections since I didn't have Jellyfin's ports open, but the client IP being passed makes sense.