Can't connect to server from outside the network on emby app for xbox and windows

[Kyito 0]

Hello, This is my first time posting here so apologies if I do something incorrect.

Simply as the title says I can't connect to my emby server  from outside my network using the emby apps. The only exception is the android app. I am using emby server version 4.8.10.0 and windows app version 2.211.2.0. I also have emby premier. I use the emby app on my xbox and my pc (windows 10) and they connect to my server just fine but there connected to the same network the server is on. Outside my network i can connect to my server using a browser or using the emby app on my android. But when trying to use the xbox app, samsung tv app, or windows app outside my network they wont connect. I have tried this on multiple other networks and always the same result (Unable to Reach Server We're unable to connect to the selected server right now. Please ensure it is running and try again.). I also have an ssl cert for my server and set it to required for all remote connections. I'm stuck on what the problem might be, my only theory right now is either my network blocking the apps connection or the other networks blocking the apps connection.

[seanbuff 1316]

*Moving to General / Server section*

@Kyitowhich of the steps in this guide have you completed: Remote Setup

Do all connectivity tests succeed? eg. canyouseeme.org

[Kyito 0]

I have turned on allow remote connections. I do have automatic port mapping turned on, however I have the appropriate ports forwarded on my router. I also have allowed the ports in windows firewall on the server machine. I'm also using a dns through noip which works with the bowser and Android app. Allow remote connections is turned on and canyouseeme.org succeds with my ip on port 8920. Side note, I have tried using both the dns and my public ip in the emby apps outside my network. Both result in the same error mentioned above

[seanbuff 1316]

1 hour ago, Kyito said:

Allow remote connections is turned on and canyouseeme.org succeds with my ip on port 8920

Okay, so now you've confirmed connectivity works, next I would focus on TLS. Have you tried secure connection mode to "Preferred, but not required" or even "Disabled" and using port 8096?

[Kyito 0]

Yes I did try turning it off and setting it to preferred. Unfortunately I still got the error

[Luke 42078]

Hi, have you checked to see if your ISP uses a CGNat? If so this may require tailscale or a vpn.

[Kyito 0]

I'm not sure. How can I check this?

[Lessaj 467]

Since it's working from a web browser and the android app that means the port forwarding is working correctly and you're not behind a CGNat. Sorry it's not clear from your last post, did you end up disabling secure connection mode and also trying to connect with 8096? Do you have 8096 forwarded as well? The reason to check this is because it may be working internally if it's just falling back to 8096 because it's actually rejecting the certificate for those apps, but externally if that port isn't open then it won't be able to connect. The apps may be rejecting the certificate depending on the CAs, whereas as a web browser/android may trust that CA in the chain, perhaps if it's a newer CA for example.

[Kyito 0]

I did not have port 8096 forwarded. I have secure connection mode set to preferred but not required. It looks like it's working now. This makes sense as I have a self signed cert that I'm using so the browser has to accept the connection. I will look into getting a real ssl cert. Curious tho why the android app did not reject the ssl though and the others do?

[Lessaj 467]

Do you have the cert added on the device? I add the cert from my hypervisor.

[Kyito 0]

I do not. I guess I assumed the emby app would automatically add the required cert to the device, or provide a popup like the browsers do asking permission from the user. How would you add self signed certs to devices like xbox and tv?

[Lessaj 467]

I'm not aware unfortunately but you should be able to get a letsencrypt certificate pretty easily.

[Luke 42078]

On 1/29/2025 at 9:09 PM, Kyito said:

Curious tho why the android app did not reject the ssl though and the others do?

Every device is going to be different when it comes to things like this.

[Luke 42078]

On 1/29/2025 at 9:15 PM, Kyito said:

I do not. I guess I assumed the emby app would automatically add the required cert to the device, or provide a popup like the browsers do asking permission from the user. How would you add self signed certs to devices like xbox and tv?

To my knowledge this isn't even possible with a samsung tv. Unfortunately that means you either need to use an SSL certificate that it trusts, or not use SSL at all.