Can't for the life of me, set up remote access to server, after hours of tinkering

[numetalfan89 1]

Hello all,

So I've been trying to set up my sever for remote access, so friends can sign in using emby connect to be able to access my media library. I've gone through the official guide and tried port forwarding on my router settings and still nothing (note: I do not have two routers). I'm very new to this, so if someone would be able to explain this simply for me that would be amazing.
I set this sever up late last year, was able to get everything running smooth for home network use, with the intention of wanting to extend the connection to friends.
I also have a tp-link ac2800 router if that helps, and running the server on debian 12, using gnome.

[Luke 39992]

Hi there, what exactly happens when you try to connect? Can you show us how you set up port forwarding?

[numetalfan89 1]

12 minutes ago, Luke said:

Hi there, what exactly happens when you try to connect? Can you show us how you set up port forwarding?

Thanks for the quick response, here's a screenshot of my port forwarding setup, and one of what happens when I try to connect to the server on my hotspot. I'm feeling like I'm not using the correct IP with the port forwarding.

[Luke 39992]

Well that looks like your LAN IP. You wouldn't use that to connect remotely. You should be connecting remotely using your remote address.

[numetalfan89 1]

1 hour ago, Luke said:

Well that looks like your LAN IP. You wouldn't use that to connect remotely. You should be connecting remotely using your remote address.

Ah of course, well I changed the ip to the Remote (WAN) access ip that's included on the dashboard section in emby's settings, unfortunately my router settings has hit me with: Error code: 4937
The IP address is not on the same subnet with LAN IP address. Please input another one.

[Q-Droid 878]

Your internal IP in port forwarding is correct (?) but to connect to the server remotely you enter the router's internet (WAN) IP. Your server dashboard should display both LAN and WAN IP. 

 

Edited April 2 by Q-Droid

[Luke 39992]

Quote

Error code: 4937
The IP address is not on the same subnet with LAN IP address. Please input another one.

can you please show a screenshot? Thanks.

[numetalfan89 1]

10 hours ago, Luke said:

can you please show a screenshot? Thanks.

The IP that I've scribbled out is the one that's shown on my emby dashboard for the Remote (WAN) access IP.

[Q-Droid 878]

Does the Internal IP on the router port forwarding page match the LAN IP of your Emby server? If they match then you don't need to change port forwarding from what you show in the first image in this thread. The internal IP is the correct value there.

When you connect to your server remotely you need to use the WAN IP that is shown on your server dashboard. It might be confusing that the "help" text also matches your server LAN IP, ignore that.

Also if you're not running HTTPS on your server, which is most likely, then you need to use the HTTP URL for Emby connect, not the HTTPS URL. This can be a challenge because most browsers will automatically redirect to HTTPS unless you disable/override that feature.

 

[Q-Droid 878]

Another thing to check is whether you can connect directly to your server not using Emby Connect. Navigate to your server's WAN URL from a browser or mobile device with WiFi turned off and on the mobile network. You should land on the Emby login page.

 

[rjwill10 2]

I'd recommend using a Cloudflare tunnel. I've been using it without issue, and it works for other services as well. This means you don't have to open ports to the web. 

I purchased a cheap domain from Cloudflare, for less than £10 for 2 years, and the tunnel is free to use. 

I used the following guide to set it up. The guide is for Plex, but applicable to Emby. Just make sure you disable caching for your Emby sub domain (emby.yourdomain).

https://mythofechelon.co.uk/blog/2024/1/7/how-to-set-up-free-secure-high-quality-remote-access-for-plex

Cloudflare also allow you to set zero trust authentication for services via Google, or GitHub. This adds an extra layer of security for your none emby services. Unfortunately you can't use this feature with emby unless you're accessing it from a browser. The native Android app/TV apps don't allow it, but you wouldn't be able to do that with direct access to your network either. 

 

[Lessaj 293]

You said you don't have 2 routers but your screenshots are from a TP-Link router, which would not be an ISP provided gateway to my knowledge, so you must have an upstream gateway where you need to perform the port forwarding, unless your ISP gateway is in bridge mode then I believe it would be correct to perform the port forwarding on the TP-Link router, but in that case you would first need to check if your WAN is a cgNAT or not.

[numetalfan89 1]

13 hours ago, Q-Droid said:

Another thing to check is whether you can connect directly to your server not using Emby Connect. Navigate to your server's WAN URL from a browser or mobile device with WiFi turned off and on the mobile network. You should land on the Emby login page.

 

This doesn't work the connection just times out

13 hours ago, Q-Droid said:

Does the Internal IP on the router port forwarding page match the LAN IP of your Emby server? If they match then you don't need to change port forwarding from what you show in the first image in this thread. The internal IP is the correct value there.

When you connect to your server remotely you need to use the WAN IP that is shown on your server dashboard. It might be confusing that the "help" text also matches your server LAN IP, ignore that.

Also if you're not running HTTPS on your server, which is most likely, then you need to use the HTTP URL for Emby connect, not the HTTPS URL. This can be a challenge because most browsers will automatically redirect to HTTPS unless you disable/override that feature.

 

Yeah they don't match, and when I put that IP that's on emby into my port forwarding settings, it hits me with a 
Error code: 4937
The IP address is not on the same subnet with LAN IP address. Please input another one.

[numetalfan89 1]

10 hours ago, Lessaj said:

You said you don't have 2 routers but your screenshots are from a TP-Link router, which would not be an ISP provided gateway to my knowledge, so you must have an upstream gateway where you need to perform the port forwarding, unless your ISP gateway is in bridge mode then I believe it would be correct to perform the port forwarding on the TP-Link router, but in that case you would first need to check if your WAN is a cgNAT or not.

I just checked the website whatsmyipaddress.com and my wan address in my router settings does not match, so I believe it is cgNAT.

[Luke 39992]

45 minutes ago, numetalfan89 said:

I just checked the website whatsmyipaddress.com and my wan address in my router settings does not match, so I believe it is cgNAT.

OK then it sounds like you will need to use either a VPN or TailScale for remote access. I know TailScale is popular.

[numetalfan89 1]

18 minutes ago, Luke said:

OK then it sounds like you will need to use either a VPN or TailScale for remote access. I know TailScale is popular.

I've currently got PIA, tried looking up how to set it up but every post is confusing and not sure if people have the same issue as me or not.

[Q-Droid 878]

11 hours ago, numetalfan89 said:

Yeah they don't match, and when I put that IP that's on emby into my port forwarding settings, it hits me with a 
Error code: 4937
The IP address is not on the same subnet with LAN IP address. Please input another one.

Something odd about this. Are you running a VPN client on the Emby host? Is 192.168.1.100 a different machine and if so then what is the LAN subnet? Is the router not allowing it because the IP is not in its DHCP range?

 

Edited April 4 by Q-Droid