Jellyfin foz Android TV - Unable to connect

[shadow82]

Hi!

My friend, who has user account for my Jellyfin server can't connect when using Chromecast client.
The client is unable to connect despite correct url. 



Connection from Android phone client works well for him. Also screen cast from phone to TV works well, but not jellyfin-androidtv.
From my perspective: regular Android, WebOS client, Web App on Win11 works fine - from LAN and from public Internet

Client unable to connect on Chromecast: jellyfin-androidtv 0.18.4
Jellyfin server 10.10.5 (running on Docker on Linux)
[url=https://preview.redd.it/chromecast-client-unable-to-connect-v0-8s5jbkd7zpje1.jpg?width=1132&format=pjpg&auto=webp&s=624e5762948d8892511738c918291ab4c1e843af][/url]

[theguymadmax]

Upgrade to 10.10.6

[shadow82]

Did it
sudo docker compose down
sudo docker compose pull
sudo docker compose up -d

After that my versions are:
Server version: 10.10.6
Network version: 10.10.6
Compilation version: 10.10.6

But hte behaviour is the same.

• Windows Web app client works fine
  
• Android client works fine
  
• WebOS client works fine
  
• Chromecast client is unable to connect to the server.
  

It seems it tries to connect also via ports 8096 and 8920 which are not allowed on my FW.
It works like this:

1. Client request to https://tv.acme.com:443 is terminated on FW
   
2. FW proxy with new request to http://jellyfin.home:8082
   
3. Request lands on Docker container and is port forwarded to port 8096
   

Below my docker-compose.yml file

Code:

Services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Warsaw
    volumes:
      - /home/shadow82/docker/jellyfin/config:/config
      - /mnt/Storage/Movies and Shows:/media
    ports:
      - 8082:8096
    restart: unless-stopped

[TheDreadPirate]

You should configure Jellyfin to directly use port 8082.

Also, where does your reverse proxy reside?

[shadow82]

ok. changed the port redirection in docker-compose.yml file to: - 8082:8082 and in jellyfin config.
No change after this one.

I have a drawing here: https://imgur.com/qbDZkZo
It shows which client flows work fine and which doesn't
FW listens only on port 443. The rest of types of clients (Android app, Win11 web browser, LG WebOS client) work fine using the same way

Here is wireshark dump when connecting to tv.acme.com (and it doesn't work) https://imgur.com/bT2GZcE
Here is wireshark dump when connecting to demo.jellyfin.org (it it does work) https://imgur.com/zhQns8g
Here is wireshark dump when connecting from my Win11 laptop webbrowser to tv.acme.com (same Wi-Fi) https://imgur.com/hHQFOcV
Here is wireshark dmp with the same laptop connecting to demo.jellyfin.org https://imgur.com/45BgbqE

I think the only bad thing here are 50% of retransmissions when connecting from Chromecast 4K, but if:
- I'm getting them only when using Chromecast 4K
- There are not retransmissions when connecting from my laptop
- Other clients works fine both via home LAN and Internet except Jellyfin for Android TV

Then something must be wrong with that client or Chromecast 4K is poor network endpoint...

[TheDreadPirate]

I have two Chromecast 4Ks. Neither have this issue. So it is either a faulty WiFi antenna, just a faulty device in general, or the signal is weak where the device is located.

[shadow82]

I have two Chromecast 4Ks.  Neither have this issue.  So it is either a faulty WiFi antenna, just a faulty device in general, or the signal is weak where the device is located.

Well - antenna is like 50cm from Chromecast.
The same Chromecast plays videos from the same source via SMB and VLC player with no issues.
Truth is the client is being checked by FW and if it connects anyhow wrong, FW will drop the connection.

3 other type of clients work well using the same connection

[shadow82]

How do you keep your service secure against dirty Internet?

[TheDreadPirate]

I used alternate ports for external connections (significantly reduces connection attempts) and fail2ban for the rest.

I disable root login via ssh, I disable password logins via ssh (PKI only), and I lock down connections to TLS1.2 and 1.3 and only with secure ciphers.

[shadow82]

I used alternate ports for external connections (significantly reduces connection attempts) and fail2ban for the rest.

I disable root login via ssh, I disable password logins via ssh (PKI only), and I lock down connections to TLS1.2 and 1.3 and only with secure ciphers.

Hmm... So there is no protection against robots scanning the net and finding software vulnerabilities...
I as for now exposed the service with port 443 for HTTPS and 8096 for HTTP and Jellyfin for Android TV works fine, which means it cannot set TLS session correctly.
I will go with it fo FW and Wireshark people and see what's going wrong there and why FW drops these requests, while other clients work fine.