Emby Server on Shield TV Pro and VPN Concept

[Daxman27 1]

This is more of a technical question but I would like to verify with the experts if my concept of how Emby works is correct.

Let me first clarify that this is for local use only, I am not trying to connect remotely to the Emby server.  I did some research and most of the posts are about trying to setup a VPN for remote access to the server.

I want to keep my privacy and I use VPN on the Shield TV Pro where the Emby server is running. I have Emby Live TV setup and I am getting a IPTV feed using the M3U tuner as the TV source. I am also getting an XML feed for the TV Guide data feed.

My assumption is that as long as the VPN is up and running on the Shield TV Pro where the Emby server is running, any connection to the IPTV service provider (Stream) thru the Emby server happens inside the VPN connection. Regardless if the client (another android tv, FireTV) I am using to connect to the Emby server (locally) has a VPN or not. 

All my clients are inside my network connecting directly to the Emby server using the local IP address. Everything stream well but I want to have piece of mind that regardless of any setting on the server or the client, all communication between the Emby server and the outside provider is happening with the VPN connection and not visible to the outside.On the other hand since the connection between the clients and the Emby server stays local and not visible outside my network, In other words the client does not try to direct-play the source form the provider.

Am I correct on my concept of how it works?

Thanks.

 

 

 

[Carlo 4330]

VPN can be used but might be problematic for you as the admin depending on what you're trying to do.

First if you are thinking of using a PUBLIC VPN don't as that will actually cause you more security issues as your Emby server now has an IP on the PUBLIC VPN IP pool.  In the case of using a public VPN server only half the transmission is "secured" as well. 

If you are going to setup VPN in your local network with usernames/password that friends/family will use then this causes other issues as you limit how your friends can get to your server as they have to have VPN setup in their environment which likely means their Smart TVs, Android TV, Rokus, etc won't be able to get to your server.

What exactly is your intent with thinking of using VPN?

[Daxman27 1]

6 minutes ago, cayars said:

What exactly is your intent with thinking of using VPN?

I don't know what you mean by public VPN. I am using ExpressVPN.  I just have the expressVPN app running on the Shield TV so any apps connecting to the outside uses the VPN, including the  Emby server. 

The VPN app assigns a different IP address (104.102....) to the Emby server, based on the VPN server location I am connected to but I have my Emby server setup to use the local IP address 192.168...) assigned to the device by my local router so any clients, inside my network, can connect and they do.

This works for me, what I am trying to verify is that the connection between the Emby server and the M3U source (IPTV service provider) is secure. I don't care about securing the connection between the clients and the Emby server since, I assume, is all local and not seen outside my local network.

 

So they way I see it:

local Emby Clients (192.168....) ----> (192.168....) Emby Server on Shield TV (104.102...) ----->VPN Tunnel---------->VPN Server --------->IPTV Service Provider

 

I hope this makes sense.

[Carlo 4330]

ExpressVPN is a PUBLIC VPN service.  These types of services only help you hide your activity from your provider and that's it.  So they are useful in hotspots or to hide activity from the ISP but don't offer protection to you as a whole because your traffic is only partially encrypted or hidden from you to the VPN provider but once it leaves the VPN provider it's fully open to the internet.

A Private VPN is one you yourself setup on your side and a client app is used on the remote side so all traffic is fully secure.

These public VPNs have issues of their own for Emby.  Since you have hundreds to thousands of users on these IPs people do things like hack or scrapes sites so they tend to get blocked. Many of the MetaData providers needed by Emby do this type of blocking so if your server uses a VPN like this it won't be able to fetch meta data or posters...

If you want your Emby Server to connect to your IPTV provider over a VPN the best way to do this is use a router that supports VPNs and has split tunneling or allows you to change the routes used.  This way you can force IPTV traffic to use the VPN while other Emby traffic does not use the VPN.

Carlo