Problem with remote playback

[ice-p]

Ok, will try with disabled proxy. Is disabling proxy an security risk or is it ok?

Here is the nginx-proxy-config:
https://pastebin.com/u9Mhmbeh

[TheDreadPirate]

I don't want you to disable the proxy permanently. But let's remove it as a factor briefly. Can you share the contents of these three files?

conf.d/include/block-exploits.conf
conf.d/include/proxy.conf
/data/nginx/custom/server_proxy[.]conf

[ice-p]

i was not able to paste it in pastebin because of the content. Here are both files, the server.conf file did not exist in my environment.

Code:

cat block-exploits.conf
## Block SQL injections
set $block_sql_injections 0;

if ($query_string ~ "union.*select.*\(") {
set $block_sql_injections 1;
}

if ($query_string ~ "union.*all.*select.*") {
set $block_sql_injections 1;
}

if ($query_string ~ "concat.*\(") {
set $block_sql_injections 1;
}

if ($block_sql_injections = 1) {
return 403;
}

## Block file injections
set $block_file_injections 0;

if ($query_string ~ "[a-zA-Z0-9_]=http://") {
set $block_file_injections 1;
}

if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") {
set $block_file_injections 1;
}

if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") {
set $block_file_injections 1;
}

if ($block_file_injections = 1) {
return 403;
}

## Block common exploits
set $block_common_exploits 0;

if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
set $block_common_exploits 1;
}

if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
set $block_common_exploits 1;
}

if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
set $block_common_exploits 1;
}

if ($query_string ~ "proc/self/environ") {
set $block_common_exploits 1;
}

if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") {
set $block_common_exploits 1;
}

if ($query_string ~ "base64_(en|de)code\(.*\)") {
set $block_common_exploits 1;
}

if ($block_common_exploits = 1) {
return 403;
}

## Block spam
set $block_spam 0;

if ($query_string ~ "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") {
set $block_spam 1;
}

if ($query_string ~ "\b(erections|hoodia|huronriveracres|impotence|levitra|libido)\b") {
set $block_spam 1;
}

if ($query_string ~ "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") {
set $block_spam 1;
}

if ($query_string ~ "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") {
set $block_spam 1;
}

if ($block_spam = 1) {
return 403;
}

## Block user agents
set $block_user_agents 0;

# Disable Akeeba Remote Control 2.5 and earlier
if ($http_user_agent ~ "Indy Library") {
set $block_user_agents 1;
}

# Common bandwidth hoggers and hacking tools.
if ($http_user_agent ~ "libwww-perl") {
set $block_user_agents 1;
}

if ($http_user_agent ~ "GetRight") {
set $block_user_agents 1;
}

if ($http_user_agent ~ "GetWeb!") {
set $block_user_agents 1;
}

if ($http_user_agent ~ "Go!Zilla") {
set $block_user_agents 1;
}

if ($http_user_agent ~ "Download Demon") {
set $block_user_agents 1;
}

if ($http_user_agent ~ "Go-Ahead-Got-It") {
set $block_user_agents 1;
}

if ($http_user_agent ~ "TurnitinBot") {
set $block_user_agents 1;
}

if ($http_user_agent ~ "GrabNet") {
set $block_user_agents 1;
}

if ($block_user_agents = 1) {
return 403;

and here the other file

Code:

cat proxy.conf
add_header      X-Served-By $host;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto  $scheme;
proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP          $remote_addr;
proxy_pass      $forward_scheme://$server:$port$request_uri;

[TheDreadPirate]

Your nginx config looks fine.

Ok, will try with disabled proxy. Is disabling proxy an security risk or is it ok?

Coming back to this, are you asking about disabling nginx?  Or the cloudflare proxy?

[ice-p]

I asked about cloudflare proxy. Nginx i would never disable for something published outside

[TheDreadPirate]

Its only a security risk if you don't trust the people you share Jellyfin with.

[ice-p]

ok understand, thanks

So nginx should work fine. I will start a test with my friend to check without proxy on cloudflare enabled.
any other sugeestions?

What I think was weired is, that the mobile phones would work out of the box even with proxy enabled. Just fire-tv has these problems.

[ice-p]

atm we are having issues with my friend authenticating. Since i disabled proxy on cloudflare he is not able to connect and gets an timeout error when trying to connect to my url.

from mobile phone it is working, also when i try to connect from my site or cellular i can connect. any ideas? i would like to test it but atm not possible. We also restarted the router, deleted the app on firetv and booted the fire tv stick.

[TheDreadPirate]

Maybe DNS caching? What client are they using?

[ice-p]

the standard jellyfin app for fire tv stick