Unable to access remotely

[crusher11 1101]

Time error from CloudFlare. LAN HTTP IP works, LAN HTTPS IP fails due to an invalid cert. 

Been set up with SSL through CF for years, not sure what's happened? 

[brothom 177]

23 minutes ago, crusher11 said:

Time error from CloudFlare. LAN HTTP IP works, LAN HTTPS IP fails due to an invalid cert. 

Been set up with SSL through CF for years, not sure what's happened? 

Cloudflare is currently having scheduled maintenance. Maybe that's the cause of your issues? https://www.cloudflarestatus.com/

In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Dec 10, 2025 - 05:00 UTC
Scheduled - We will be performing scheduled maintenance in GIG (Rio de Janeiro) datacenter on 2025-12-10 between 05:00 and 10:00 UTC.

Traffic might be re-routed from this location, hence there is a possibility of a slight increase in latency during this maintenance window for end-users in the affected region. For PNI / CNI customers connecting with us in this location, please make sure you are expecting this traffic to fail over elsewhere during this maintenance window as network interfaces in this datacentre may become temporarily unavailable.

 

If it's not that, we'll have to know a little more about your setup. Which OS are you running Emby on. 
Via which method did you get an SSL certificate.
Can you still reach your server via your IP-address remotely (remote IP?)

[crusher11 1101]

Well, it's still not working, which makes the maintenance answer seem unlikely.

As I said in the OP, certs were acquired through CloudFlare. I'm running Emby on a Synology NAS. There's also on NGINX reverse proxy in the chain.

I'm unable to access via WAN IP either; that times out.

[Luke 42077]

Hi, have you compared your nginx setup to this?

What are the differences between your configuration and that one?

[crusher11 1101]

I copied and pasted that one when I was setting it up. 

It's worked fine for several years. 

[crusher11 1101]

Actually, come to think of it, I only recently updated to beta 4.9.2.7, perhaps that was the cause? I can't think of anything else that would have changed.

[Luke 42077]

Have you tried turning off cloudfare as a test?

[crusher11 1101]

18 minutes ago, Luke said:

Have you tried turning off cloudfare as a test?

Not sure what that means/involves. Wouldn't using my IP bypass CF? 

Edited December 11, 2025 by crusher11

[crusher11 1101]

@Luke

[Luke 42077]

5 minutes ago, crusher11 said:

@Luke

Did you try by IP? How far is the remote traffic getting? Is it getting to your reverse proxy? Did you try without the reverse proxy altogether?

[crusher11 1101]

4 hours ago, Luke said:

Did you try by IP?

Yes:

On 12/10/2025 at 11:17 PM, crusher11 said:

I'm unable to access via WAN IP either; that times out.

 

 

4 hours ago, Luke said:

Is it getting to your reverse proxy? Did you try without the reverse proxy altogether?

Disabling the NGINX docker container results in my IP and the Emby port going to an “unsupported browser” error page that looks like it's being generated by my router.

[Luke 42077]

Screenshot of that?

[crusher11 1101]

3 hours ago, Luke said:

Screenshot of that?

 

[Luke 42077]

Is it tplink?

https://community.tp-link.com/en/business/forum/topic/616702

[crusher11 1101]

1 hour ago, Luke said:

Is it tplink?

https://community.tp-link.com/en/business/forum/topic/616702

It is, but I can access the router just fine via LAN.

[Luke 42077]

I would still read that link and/or do some research on this error screen. It looks to me like you have something that needs resolving that is not emby related.

[crusher11 1101]

17 minutes ago, Luke said:

I would still read that link and/or do some research on this error screen. It looks to me like you have something that needs resolving that is not emby related.

I tried my WAN IP and Emby port in a different browser, and I got the router login page.

[Luke 42077]

Is this a statement or are you wanting a fix? This does not sound like an Emby related problem. If something is preventing the remote traffic from getting to the Emby Server application, then what would you like Emby to do about it?

I'm assuming you've already stepped through our remote setup guide:

Connecting from Client Apps

If you haven't done that since this problem started then I would start there. I know you're probably going to say that you don't need to do that because it was working before, but over time things will happen and these kinds of things need to be double checked every once in a while.

So assuming you've got your port forwarding setup properly then I think you need to look at why your router is presenting a login page rather than forwarding the traffic.

[crusher11 1101]

8 hours ago, Luke said:

I'm assuming you've already stepped through our remote setup guide:

Connecting from Client Apps

 

My WAN IP isn't visible within Emby settings, and I can't for the life of me remember where the domain is set up to point there, though that doesn't seem like it's the issue at the moment given WANIP:EmbyPort should get me Emby either way and doesn't.

The other thing is that I'm not forwarding from 8096 to 8096, I'm forwarding from  8765 to 8888. Entering my WAN IP followed by 8765 gets me my router's login page, entering my WAN IP followed by 8888 gets me “this site refused to connect.” Both are true regardless of whether NGINX is running.

[Luke 42077]

Quote

entering my WAN IP followed by 8888 gets me “this site refused to connect.”

Well this makes sense if 8888 is the internal port, not the router port.

[seanbuff 1313]

What is the purpose of Ngnix as a reverse proxy if you're just going to port forward custom ports like 8765 anyway? That kinda defeats the purpose of running a reverse proxy in the first place.

Ideally, your RP should be the only port(s) exposed to the web, on typically 443 and it will handle mapping all your internal services accordingly via subdomains. But it doesn't look like you ever set yours up that way anyway 

It also doesn't sound like you really understand how your own setup works, which is a must if you're ever expected to troubleshoot it when something eventually breaks.

I agree with Luke, doesn't sound like an Emby problem.

[crusher11 1101]

So the reverse proxy should pick up the incoming traffic on WANIP:8765, but it's instead letting it go through to the router, meaning the problem is likely with NGINX? Is that where we're at?

And yes, NGINX is set up to intercept everything coming in on 443 and send it to the right place. It's exactly  the config from the thread Luke linked to. Trying 443 gets me:

Local Management via HTTPS is disabled. Please access the device via HTTP.

The thing that gets me is that nothing about my setup has changed except the version of Emby I'm running.

[Neminem 1518]

Is this option still set in you Emby network settings.

[crusher11 1101]

20 minutes ago, Neminem said:

Is this option still set in you Emby network settings.

Yes. 

[crusher11 1101]

FWIW I don't hit my router's setup page if I'm not connected to the network, so it's not quite the gaping security hole it first seemed. If I try on my phone after turning WiFi off, I just get a timeout error.

Have also posted in the NGINX thread since that seems to be where the issue is at the moment, but I really have no idea.