Access

[Mahjack 0]

Hi folks.

I need some help. I've been trying to look for users access tutorial but I couldn't find what I want. Maybe I haven't looked in the right place. I want use emby when I'm not at home and also share with my brother who lives somewhere else, diff country. Could you please help?

[CBers 7450]

https://support.emby.media/support/solutions/articles/44002137137-remote-setup

[Luke 42078]

@cayars

[Carlo 4561]

On 11/8/2021 at 1:40 AM, Mahjack said:

Could you please help?

Have you had a chance to try what @CBers posted?

[Mahjack 0]

Hi all, sorry for the late reply as I have been really busy. I appreciate the your assistance.

 

As per what it says on the link, I do have the remote access IP on the Dashboard. But it doesn't work.

I have checked the https://canyouseeme.org/  , the ip is matching but when I put the port in, I get ""Unable to complete the request""

[Carlo 4561]

Try this.  Open a command prompt and run this:

tracert 8.8.8.8
if not using Windows and that fails try traceroute instead

Typically your computer IP will start with 192.168.
Most people have the home router set to 192.168.0.1 or 192.168.1.1

You should hopefully see every IP from your computer to the Google DNS server your trying to get to.
Once you get past your home router (ie 192.168.0.1) we want to look carefully at the next line or two.

Do they start with 10. or 172. ?

If so you are behind a CGNAT (carrier grade network address translation) and do not have a real IP on the internet.  You are basically behind the ISPs firewall and they are blocking incoming originated traffic.

Let us know what you find. If by any chance the tracert goes from your IP directly to 8.8.8.8 I almost guarantee you are using Verizon FIOS who has ICMP turned off which breaks Windows tracert.  If so I'll give you another test.

Let us know what you find.

PS just to clarify these 3 things:
You are not using any type of VPN correct?
You do not have two routers setup correct? (ie the ISP router and your own router)
You have check the firewall if present on the Emby server to make sure it has the port open you are using correct?

[Mahjack 0]

After the ip,  the numbers start with 10.

I live in Dubai, so I'm not using Verizon but Etisalat.

Nope, I'm not using VPN. And I only have ISP modem, I have TP-Link router

I checked the firewall after your comment, they're allowed and open.

[visproduction 315]

This might be possibly due to Dubai limiting Internet access.  There is a lot of info online about this: https://freedomhouse.org/country/united-arab-emirates/freedom-net/2021

[Luke 42078]

Does your isp allow opening these ports?

[Mahjack 0]

Yes, they do allow.

[Luke 42078]

6 hours ago, Mahjack said:

Yes, they do allow.

How did you verify this? What port range do they allow opening?

[Carlo 4561]

On 11/29/2021 at 1:46 AM, Mahjack said:

After the ip,  the numbers start with 10.

On 12/7/2021 at 3:07 AM, Mahjack said:

Yes, they do allow.

These are conflicting.  If you do a traceroute and get a 10.x.x.x address after the packet leaves your router in the next couple hops that will be your ISP using private IP addresses. This type of setup is normally a CGNAT which doesn't allow unsolicited inbound traffic through.

Could you do a tracert 8.8.8.8 and send me a PM with the results to look at vs posting it here (will have your WAN IP listed). I can look at your results as well as do a tracert back to for verification to get a pretty clear picture of your situation.

[Carlo 4561]

I got your PM with the tracert info.  I'm posting the top half here which is safe as it doesn't contain any private info.

What this shows is two different problems.  One is local which could be fixed but the other is out of your control.
First is what appears to be two routers inside your LAN. You have routers on 192..168.1.1 and on 192.168.0.1.  One might be a combo router/AP or something but it two devices doing routing. This would typically be fixed by turning routing off on the 1.1 AP or setting up the 0.1 to forward packets to 1.1 and then on 1.1 you forward to your Emby Server.

The second and more problematic issue is 10.246.250.61. That is a private IP address upstream from you.  That will be a 3rd NAT situation and likely a CGNAT (carrier grade NAT).  There is nothing you can do to get packets to route through this inbound.

There are a couple of ways around this but take a bit of work to setup.  If it's only you and your brother who need access depending on what apps you want to use a simple solution might be to use TailScale.  You would use the free tier and setup one client on your Emby Server and then setup a client on any device you wish to use outside your network that is supported (Mac, Windows, Linux, iOS, Android)..

The free plan allows you to have 20 devices.  You could either set your brother up on your account or have him signup and then you can manually share with him giving him access only to your Emby Server.  That by far should be the easiest method in your situation to use Emby remotely and can be done in 5 minutes or so.  It also keeps everything very secure for you.

Carlo