Accessing Emby from outside Home Network

[johnlumgair 3]

I'm struggling to access Emby from outside my home network after changing my router.

I've tried following the guide on what to do, and when I did this once before, it was easy. This time, I turned on UPnP, and I can see the Emby server listed, which suggests that the firewall isn't blocking it. 

#	Description	Destination IP Address	External Port	Internal Port	Protocol
1	Emby Server	192.xxx.x.xxx	80xx	80xx	TCP

2

upnpclient:xxx

192.xxx.x.xxx (The same IP)

53xxx

66xx

TCP

I can't log in with Emby Connect, it just brings me back to the page. If I try  Remote (WAN) access, "because the server where this page is located isn't responding"

I keep getting lost reading, but I just don't know what to focus on. 

John

[Luke 42078]

hi @johnlumgairwhat Emby app are you trying to connect with?

[johnlumgair 3]

Emby app on android version 3.4.36 and Emby theatre for Mac Osx

The emby running on my NAS is 4.8.8.0 (the latest update isn't yet available on the website for my model) 

 

Thank you

[GrimReaper 4740]

14 hours ago, johnlumgair said:

I turned on UPnP, and I can see the Emby server listed, which suggests that the firewall isn't blocking it. 

It actually doesn't mean your inbound connections are getting through your firewall. 

Can you go through connections troubleshooter and post which steps worked and which didn't (in particular canyouseemee.org  and tracert checks)? 

[johnlumgair 3]

- Remote access is enabled. 

- Enabed port remapping

- UPnP option turned on and server restarted (it's now listed on the router)

_________________________________________

I don't understand what the uPnpwizard thing is and if I need it. Am I thinking that it's now listed on the router and that this step isn't needed?

 

Quote

There are tools available to show you what ports are mapped in the router through uPnP. These are useful, because not all routers give details of what dynamic port mapping through uPnP is active. One such tool is uPnp Wizard.

the canyouseeme.org couldn't find it. 

I'm not using a VPN. 

It's all gotten so complicated! Last time, all I had to do when I changed my ISP and router was update an IP number, and it just worked. Do I need to look into setting up port forwarding now?

[pwhodges 2012]

Have you changed your ISP this time, then?

If so, you need to check whether they have put you on cgNAT, which blocks all incoming connections.  Is your new IP address in the range 100.64.0.0 - 100.127.255.255 ?  If so, you need either to ask your ISP for a routable address (which they may charge for, or not provide at all), or use some tunnelling mechanism to get around it - such as Tailscale.

Paul

[Luke 42078]

@johnlumgair?

[johnlumgair 3]

Thank you., Sorry I wasn't at home so I didn't get a chance to check but now I have.

I've changed my ISP a few times since having this NAS; this is the one that has been tricky. 

1. The IP address is a higher number it starts with 140
2. I don't understand what cgNAT when I log in I can see section called NAT  but I don't know what to do

thanks again

 

[pwhodges 2012]

cgNAT is nothing to do with your router.  It is implemented in the ISP's network, and prevents you getting into your network from outside.  All you can do is see if you're behind it, and if so ask your ISP to change it for you (probably at a price) or find a way around it (e.g. Tailscale or some other tunnel).

If your IP address starts with 140, you are likely not behind cgNAT, but doing a tracert to some outside address and posting the result here would enable us to confirm that.

Paul

[Luke 42078]

@johnlumgairdoes this help?

[johnlumgair 3]

thank you both.

this is very much at the far fringes of my knowledge and I don't understand all the words! But I ran a "traceroute" followed by the external ip address for my emby server this is the result

Quote

 

raceroute to 140.xxx.xx.xx (140.xxx.xx.xx), 64 hops max, 40 byte packets

 1  hyperhub (192.xxx.x.x)  4.156 ms  2.408 ms  2.437 ms

 2  * * *

 3  * * *

 4  * * *

 5  * * *

 etc. to 64  * * *

 

I don't know any of that means!

thanks again 

[Luke 42078]

2 hours ago, johnlumgair said:

thank you both.

this is very much at the far fringes of my knowledge and I don't understand all the words! But I ran a "traceroute" followed by the external ip address for my emby server this is the result

I don't know any of that means!

thanks again 

@johnlumgair can you please follow this guide and let us know the outcome?

https://www.purevpn.com/blog/how-to-check-whether-or-not-your-isp-performs-cgnat/amp
if your isp uses a cgnat then you will need a vpn or tail scale.

[johnlumgair 3]

Thank you for helping me though this headache! After searching around for ages, I couldn't find my WAN IP. So I just googled my ISP and found out they do use CGNAT. Looks like I have to pay them extra £5 a month (which I won't - I feel cheated that they don't give me the full thing) or get a VPN. Does it work with all VPNs? 

[Luke 42078]

Paying them would be much easier than a vpn so I would just keep that in mind.

 Otherwise I would check out tailscale.

[johnlumgair 3]

Thanks taliscale has a free plan is that enough?

[Luke 42078]

18 minutes ago, johnlumgair said:

Thanks taliscale has a free plan is that enough?

Possibly but keep in mind TailScale requires installation on both the server and client machines. It works great but the requirement of client-side setup is something you can't get around. That's why I'm saying if the option from your ISP is cheap enough, you may want to consider it because it will just work without all of that setup.

[johnlumgair 3]

So every single machine that I want to use emby on I'd need to install tailscale? It's really does seem like a pain. Is that the case with all VPNs?

I resent paying anything extra money to my ISP as they haven't bern a bad service so far and I feel like I'm rewarding them removing capabilities. 

[Luke 42078]

Just now, johnlumgair said:

So every single machine that I want to use emby on I'd need to install tailscale? It's really does seem like a pain. Is that the case with all VPNs?

I resent paying anything extra money to my ISP as they haven't bern a bad service so far and I feel like I'm rewarding them removing capabilities. 

@Carlo may have some tips on that.

[pwhodges 2012]

Does your ISP provide you with IPv6?

If so, you could try using only your machine's routable IPv6 address, as that will surely not be subject to cgNAT.  I don't know if anyone has tried this route, though.

Paul

Edited March 23, 2025 by pwhodges

[Carlo 4561]

On 3/22/2025 at 7:37 PM, johnlumgair said:

So every single machine that I want to use emby on I'd need to install tailscale? It's really does seem like a pain. Is that the case with all VPNs?

I resent paying anything extra money to my ISP as they haven't bern a bad service so far and I feel like I'm rewarding them removing capabilities. 

With TailScale you have two options.
The first is to setup each client or client network with a TailScale client so that devices can access the mesh network.

The second option is using a TailScale Funnel which is new and in beta, 
https://tailscale.com/kb/1223/funnel

A funnel allows the ability to have normal Internet traffic routed to your server.

[johnlumgair 3]

HI @pwhodges I really appreciate your help.

I took a bit of time as I'm out of my depth in understanding, and so I have to not only be at home but also have time to get my head around it. 

I have the options: 

LAN IPv6 Mode Setup, IPv6 is currently togged to Active.

Link Local Address Type: 

The options are:

EUI64 or Manual

LAN Global Identifier Type:

The options are:

EUI64 or Manual

LAN IPv6 Prefix Setup

The options are:

Delegate prefix from WAN or Static

LAN IPv6 Address Assign Setup

The options are:

Stateless or Stateful

LAN IPv6 DNS Assign Setup

The options are:

From RA  & DHCPv6 Server or From DHCPv6 Server or From Router Advertisement

DHCPv6 Configuration

The options are:

DHCPv6 Active or  DHCPv6 Server

IPv6 Router Advertisement State

The options are:

RADVD Active or Enable

IPv6 DNS Values

IPv6 DNS Server 1:

From ISP

User Defined

None

Proxy

IPv6 DNS Server 2:

From ISP

User Defined

None

Proxy

IPv6 DNS Server 3

From ISP

User Defined

None

Proxy

DNS Query Scenario

ipv4/Ipv6 DNS Server

IPv6 DNS Server only

IPv4 DNS Server only

 

IPv6 DNS Server first

IPv4 DNS Server first