Can't Connect Remotely (Emby Connect)

[timgreen 14]

Hi,

I am unable to connect to my server remotely through Emby Connect. It's been an issue for about a year, but I only now have time to troubleshoot (I mostly watch at home anyway, but would like to be able to use it remotely).

I've had a look but can't find anything to troubleshoot. Anyone able to push me in the right direction?

Thanks! :)

[seanbuff 1315]

4 hours ago, timgreen said:

Anyone able to push me in the right direction?

I would start here: Connecting from Client Apps

[Luke 42077]

Hi there, what exactly happens when you try to connect?

[timgreen 14]

A very long loading weel, and then it asks me to Select a Server. Clicking on the server, you get a loading wheel for a very long time, before I get an "Unable to Reach" error.

I have gone through the link seanbuff sent, and got to the point of the uPnp Wizard. There I noticed the uPnp Wizard is showing a different External IP Address than the Emby Dashboard. Could this be the issue?

[timgreen 14]

I have now also set up port forwarding and turned off automatic port mapping, and still no luck.

 https://www.canyouseeme.org/ is showing a 'Connection Timed Out' error, but is showing the same IP address as in Emby, not the UPnP Wizard.

[timgreen 14]

I have now also tried a different remote port (38096) and mapped it to 8096 in my router settings, and I get the same error in Can You See Me and can still no longer connect remotely.

[GrimReaper 4739]

6 minutes ago, timgreen said:

https://www.canyouseeme.org/ is showing a 'Connection Timed Out' error

As long as you're seeing that, it'd mean your server is unreachable and no remote connection can be established, so internal connections must be troubleshooted first. 

8 minutes ago, timgreen said:

I have now also set up port forwarding

How did you do that? 

What is your server LAN IP? 

[timgreen 14]

I used my router settings to set up a TCP Port Forward from external port 8096 to internal port 8096 and turned off Automatic Port Mapping in the Emby settings.

I then changed the external port to 38096 in both the router and Emby settings to try that.

The server's IP is  http://192.168.86.226

Edited December 1, 2025 by timgreen

[GrimReaper 4739]

12 minutes ago, timgreen said:

I used my router settings to set up a TCP Port Forward from external port 8096 to internal port 8096. The server's IP is  http://192.168.86.226

Great, can you share a screenshot of that? Also, since you've posted under General/Windows I'd assume it's a Win server - is your network set to Public or Private? Are you using Windows Firewall or 3rd-party one? 

Edit: Is that address within your router's DHCP pool? Do you maybe have double NAT in your network chain? 

Edited December 1, 2025 by GrimReaper
Append

[timgreen 14]

It's not on Windows, sorry about that. It's in a Docker container on an Unraid server. I couldn't find the correct forum for that, so I thought 'General' was best.

Attached is a screenshot of the TCP Port Management settings.

[GrimReaper 4739]

*Moved to Linux forum*

In that case I'd assume it'll likely be related to docker/host network translation and some fellow member more familiar with that particular setup might chime in and offer some insight. 

[Luke 42077]

have you checked to see if your ISP is using a CGNat?

[Tur0k 148]

These would be my high level instructions: 

1. Describe your network equipment.  We need to know what kind of home Internet, Modem, Router/firewall, etc you have. 

• We need to rule out a Double NAT issue/CGNAT issues

2. Get your public IP.  Services like https://www.whatsmyip.org can help here.  Then check the IP address in your modem or home router that is tied to your WAN network interface.  Ensure that the IP on your home modem/router's WAN network interface is not a private IP address (if it is you likely have a CGNAT and will need to setup a cloud proxy (see below).  Private IP addresses look like the below: 

• 10.0.0.0 – 10.255.255.255
• 172.16.0.0 – 172.31.255.255
• 192.168.0.0 – 192.168.255.255

3. make sure that your Server gets either a Static IP or a DHCP reservation from your home router/firewall. 

4. Depending on the type of router/firewall you will need to figure out how to port forward from your Wide Area Network (WAN) physical interface to the static IP/DHCP reservation you are hosting the Emby Server Docker container on.  

• Then use a public Internet port scanning service to make sure the port is open and forwarded to the right internal server IP and port number.  https://www.whatsmyip.org/port-scanner/ is pretty good at this.  

5.  You will need to ensure that you have setup remote access settings in "manage emby server" menu (gear icon in the top right) - network tab. (See Attached)

• Enable the "Allow remote connections to this emby server" radio button
• Update the "Public HTTP port number" or the "Public HTTPS port number" to match what you setup on the firewall WAN port for open ports.  

6. Extra points if you setup some type of Dynamic DNS (DDNS) domain name that dynamically links your public IP address to your public IP. 

• I personally use Cloud Flare as a Domain name and public DNS provider only.  it is pretty cheap and they offer an integrated DDNS update service that I setup my firewall to automatically keep up to date in the event my public IP changes (I don't pay for a static IP).  
• If you do go this route tou can also add this to the External Domain section of the "manage emby server" menu (gear icon in the top right) - network tab. (See Attached).

7. Whenever you make something accessible on the Public Internet I would recommend setup of encryption in transit.  Generally your options are:

• TLS/SSL encryption either within emby, from a reverse proxy.  
  • you could go through adding openvpn and setting up a self signed certificate (i think there are a bunch of instructions on how to do this) but all clients will get a message saying your certificate is untrusted.  
  • you also could go through and purchase a Public Key Infrastructure (PKI) publicly trusted certificate.  There is a more significant cost with this and the process is cumbersome (rarely automatable) and requires you update the cert regularly.  
  • The method I like most is offloading Encryption handling to a reverse proxy there should be some relatively good videos on how to set them up and there is a thread here that goes over config setups.  Then use a service like Let's encrypt to get free TLS/SSL certs.  they even make apps and integrations that handle automated updates of the certs.  
    • Some of the reverse proxies offer Let's Encrypt SSL certificate setup integration.  This allows you to keep costs down to near 0 as well as automating the update process.  
      • I like nginx proxy manager for this feature.  
• Cloud proxy service.
  • Cloud flare has this in their offering but I am pretty sure they don't support hosting streaming services across their Free tier cloud proxy service.  
• cloud mesh (tailscale or some other alternative like it)/ a private VPN service (wireguard, openvpn).
  • I use Wireguard but only for remote management when I am not at home.

 

 

Edited December 1, 2025 by Tur0k

[timgreen 14]

49 minutes ago, Luke said:

have you checked to see if your ISP is using a CGNat?

Yes, it looks like they are using a CGNat.

[Tur0k 148]

Agh, CGNAT nonsense...  I suspect the only way around this is going to be a cloud proxy service like cloudflare or a cloud mesh VPN like Tailscale.  I think CloudFlare does not support streams in their free tier though.  Nice part is they would handle offloading the SSL support on their side of the cloud proxy.  

Edited December 1, 2025 by Tur0k

[timgreen 14]

I have spoken to my ISP and they have now disabled CGNAT on my account. I'm not at home to restart everything and troubleshoot, but I'm hoping that will resolve it.

Edited December 1, 2025 by timgreen

[Luke 42077]

OK please keep us posted. Thanks.

[timgreen 14]

Checked a couple hours later, and all is now working. Thanks all for your help!