Remote access to EMBY – how to do it safely?

[Bolongo 1]

Hi,

I switched from PLEX to EMBY Premiere.

I have EMBY installed on Synology DS220+.

I also have an Asus RT-AX86U router and a dynamic IP address from my provider.

I've been trying to set up remote access to EMBY for some time now, but I can't figure it out.

From what I've read, the safest option is a VPN connection (no port forwarding).

Please help – I'm a newbie IT.

[Luke 42077]

hi, have you setup the vpn yet?

[Bolongo 1]

Yes, I tried to set it up.

1. First, I set up DDNS. 

2. Then I set up VPN. I tried OpenVPN and WireGuard, but neither of them https://www.asus.com/support/faq/1011725/ works. https://www.asus.com/support/faq/1048280/ and https://www.youtube.com/watch?v=rSvHQw0KwvM

Edited August 13, 2025 by Bolongo

[Q-Droid 989]

Did you try the VPN connection? If you have WAN ICMP (ping) disabled in your router you won't get a response but the connection to Wireguard should still work.

 

[Bolongo 1]

Yes, I tried. Both OpenVPN and WireGuard. They didn't connect to the router.
I've read various forums and maybe the problem is on the ISP side, maybe I have CGNAT?
I'll talk to the ISP helpdesk today.

[Q-Droid 989]

That should be easy enough to check. Compare your router WAN IP to what you get from https://canyouseeme.org/.

You can also use that site to test your VPN port.

 

 

 

Edited August 13, 2025 by Q-Droid

[yocker 1247]

For vpn you can look up tailscale, might be the easiest vpn out there.

[Bolongo 1]

These are the same IP addresses.

[Q-Droid 989]

The WAN IP for your router, not the Emby server. You want to compare the router WAN interface because with CGNAT your detected public IP and assigned public IP would be different.

 

 

 

[Bolongo 1]

On 8/13/2025 at 2:23 PM, Q-Droid said:

The WAN IP for your router, not the Emby server. You want to compare the router WAN interface because with CGNAT your detected public IP and assigned public IP would be different.

 

 

 

I found out that my internet provider uses CGNAT. Everything became clear.

I installed Tailscale on Synology.

https://tailscale.com/kb/1131/synology

Thank you all for your help :-)

[mtrow28 2]

Echoing @yocker, I use tailscale. No ports to open on the firewall, no firewall forwarding, no exposure to the public internet. Create a free account, put tailscale on the NAS and your phone, point emby to the NAS' tailscale address on port 8096 from your remote device, done. Works like a charm for me, I'm streaming music everywhere I go.