Able to reach server by browser, but not apps

[mason123]

I am running Windows 11, with Jellyfin running in a docker container. All the setup is done and the app works great. I used a powershell command to generate a self-signed token for HTTPS, though I don't think that is necessary over local connections. I can use the web client from any device on my wifi via http://10.x.x.xx:8096, or https://10.x.x.xx:8920. I have also connected the http port to my cloudflare tunnel, which is publicly accessible through https://jellyfin.<mydomain>.com.

All the apps I try to connect fail. I've tried the jellyfin for Android TV (Nvidia shield device), Swiftfin on iphone and ipad, and the jellyfin for android phones. None discover any server on the wifi, and fail to connect when I enter the ip address and port. I've tried the http port, the https port, the IP with and without the port, including "http(s)/", nothing connects. I have assigned my server PC a reserved IP so it's alway at the same address on my network.

When I connect one of the apps using my public domain (https://jellyfin.<mydomain>.com, they all connect fine. This is great, but I'd really rather my TV didn't always use our internet connection and bandwidth to stream my media. I'd love it to connect locally. Anyone know how to fix this? 

I've also tried setting specific firewall rules to allow incoming traffic on ports 8096 and 8920 (on the windows pc). Not sure where to go from here. Perhaps it has to do with the self-signed certificate? The "https://jellyfin.<mydomain>.com" works, and cloudflare uses its own certificate.

I also have a plex server running in another docker container on my PC, and the Plex app on shield TV is able to connect locally just fine (at least I think it's local, I never had to point it to my server).

I attached a screenshot of the error (swiftfin on iPhone). Sorry for the long post, just wanted to give as many details as possible.

Just want to say this project is awesome, and I appreciate the work that has gone into it.

[Tim]

https with just an ip locally is never going to work. Try with the http://{ip}:8096 if you have configured that port to be used.

> I used a powershell command to generate a self-signed token for HTTPS

We strongly recommend against using self signed certificates. Only web has some basic support for that and all our clients we do not expect to work with self signed certificates. Try removing the self signed certificate and try again using http.

> I have also connected the http port to my cloudflare tunnel

We also strongly suggest against using CloudFlare's tunnel feature with Jellyfin as it is violating their ToS and they can terminate your account.

In basic you should try the following:

1) Stop using self signed certificates
2) Make sure the firewall is not the problem on the server
3) Connect to it with the configured Docker HTTP port. Not HTTPS.

[mason123]

1) Stop using self signed certificates
2) Make sure the firewall is not the problem on the server
3) Connect to it with the configured Docker HTTP port. Not HTTPS.

Thanks for the reply. Removing the self signed certificate (and the docker container volumes pointing to it) fixed the problem. I am now able to connect my apps via the http port.

I was not aware that connecting my port to cloudflare was against their ToS. If I can ask, what do people usually do? I've heard of using a VPN on a device to simulate being on their local network, but if I wanted to let my brother have a login and watch sometimes, I don't really want him "on my network" all the time. I'd rather setup a domain or url that points to my server securely.

[Tim]

It is only the tunnel feature of Cloud Flare which is against the ToS of Cloud Flare as they then have to tunnel all traffic, including video. Some common setups that people use for accessing Jellyfin is using tools like TailScale. Some people also rent a VPS somewhere and setup NGINX + a VPN tunnel back to the server (i.e., WireGuard). This method also allows for TLS/SSL certificate usage from something like let's encrypt as NGINX is used as reverse proxy. The former is easiest to setup but requires more setup on each client accessing your Jellyfin instance. The latter is more complex to setup but requires no changes on the client / user side.