Cannot access Emby outside home network

[Uncle_Frank 18]

Don't even bother port forwarding just download nordvpn and setup meshnet it's very easy and completely free. You just ignore the vpn part so you don't need to pay any money as the meshnet costs nothing to use, cheers.

Also it stopped working I bet because when you got your new modem they don't allow ports to auto open so they are doing you a favor if anything. You don't want ports open unless it's on a vps.

Edited September 6 by Uncle_Frank

[Uncle_Frank 18]

You also can install https://opnsense.org/  and block entire countries other than yours if you feel like opening up ports you can block the entire world except for a 5 block radius if you wanted  You can set this up and only connect your emby server to it and NO ONE is getting in.

[Luke 43402]

@MrGileshas this helped?

[js28194 75]

9 hours ago, Uncle_Frank said:

You also can install https://opnsense.org/  and block entire countries other than yours if you feel like opening up ports you can block the entire world except for a 5 block radius if you wanted  You can set this up and only connect your emby server to it and NO ONE is getting in.

What??  OP can't even troubleshoot a simple port forward which according to their post on 8/27 is available in their router.  You want them to install meshing with a 3rd party program and/or opensense and block 5 countries.  Why not just recommend freebsd and iptables with ufw while your at it?    OP needs to respond with some basic network configuration before we can assist at this point.  If they are indeed by CGNAT THEN they must move onto other 3rd party solutions such as Meshing or tailscale or cloudfront tunnels etc.  Until then unnecessary complexity is not the way to go.

There is nothing wrong with port forwarding if you know what you are doing.  I take it you are not.

[HtRabbit 12]

I have been using tailscale. it works flawless

[Uncle_Frank 18]

On 9/6/2026 at 11:09 AM, js28194 said:

What??  OP can't even troubleshoot a simple port forward which according to their post on 8/27 is available in their router.  You want them to install meshing with a 3rd party program and/or opensense and block 5 countries.  Why not just recommend freebsd and iptables with ufw while your at it?    OP needs to respond with some basic network configuration before we can assist at this point.  If they are indeed by CGNAT THEN they must move onto other 3rd party solutions such as Meshing or tailscale or cloudfront tunnels etc.  Until then unnecessary complexity is not the way to go.

There is nothing wrong with port forwarding if you know what you are doing.  I take it you are not.

HAHAHA  Thank you for that I spit coffee over my screen  LMAO

[cul8rmom1 12]

Are you using your own router or just the isp router?

In the Emby dashboard it should show an address for internal and external.  Does the external one match the address on your router?

There may be a dmz option on your router.  For troubleshooting you could put the address of your emby server in there and it will not block anything.  i.e. all traffic/ports hitting your public ip address would go directly to the emby machines ip.

Canyouseeme.org may not work.  I have 2 emby servers in my network and it shows the port open for one but not the other and they are both accessible externally.

 

If you are using a nas box a lot of them will typically give you free DNS resolution.  If your ISP is changing your IP address periodically that might be causing a problem that having DNS resolution would help address.

"Canyouseeme.org worked when I first tried it, but I've just tried again and it is showing a totally different IP address"  Totally different IP address from what?  What is in emby, the router?

Not really enough information to help but I would be willing to get on discord and help you for a bit if you are still having issues.

Cheers!

[MrGiles 2]

I've been away so not had chance to follow this up, but thanks to those who responded.

I have switched ISPs (again).  My new provider is Virgin Media (I am in the UK).  I am using their latest router, the Virgin Media Hub 5 with a fibre connection to my house.

In the router settings, there is a Port Forwarding menu that lets you create rules.  There is also a separate UPNP menu that, once enabled, supposedly allows devices to set up port forwarding automatically.  In the attached screenshot, there is one rule I created, and three that were added automatically by UPNP.

There is also a DMZ item in the router menu - I have tried enabling this and entering the Emby server address.

I have checked the server address in the Emby server dashboard, and this matches the address entered in the router.  The server is running on a QNAP NAS.

I have tried the following steps in the Emby troubleshooting guide:

• Ensured remote access is turned on
• Enabled automatic port mapping on Emby server and turned it on in the router
• Added a reserved address for the Emby server under DHCP
• Using canyouseeme.org, the IP address it shows matches the remote (WAN) IP address in the Emby dashboard; however, port 8096 failed with the following error message:

               Error: I could not see your service on xx.x.xxx.xx on port (8096)

                Reason: Connection timed out

• There is no VPN running on the NAS
• Turned off anti-malware & firewalls
• Traceroute - this did not produce any IP addresses beginning 10. or 192.  It did return an address beginning 172. but not in the range 172.16 to 172.31

I have also tried installing Tailscale but that didn't work either.

Nothing I've tried has made any difference, I still cannot access Emby away from my home network.  Is there anything else I should be doing?  

 

 

 

 

 

[Luke 43402]

Does your new isp use a cgnat ?

[marriedman 121]

Does the WAN IPv4 address shown in your Virgin Media Hub's connection information match the public IPv4 address shown by canyouseeme.org? You need the address assigned to the router itself, rather than the address shown in Emby's dashboard. Hub 5 appears to provide a public IPv4 connection from what I am reading, so I wouldn't assume CGNAT is your problem just yet. (I was leaning there myself at first).

Is Emby installed through Container Station? A container networking or port-publishing problem could explain your symptoms. I specifically installed Emby on a dedicated Ubuntu server to avoid container/docker issues.

Looking at your screenshot, I see one problem - your two overlapping port forwarding rules for Emby. Your manually created rule forwards ports 8080–8096, while UPnP has also created a rule for TCP port 8096. That can cause timing synchronization issues that will cause dropped the internet connection that requires a manual restart.

You should probably simplify things before doing any further troubleshooting.

• Disable DMZ on your Virgin Media Hub. You definitely don't want your entire QNAP NAS exposed to the internet. QNAP's record on security is less than stellar. (AMHIK!)

  • If you have DMZ enabled for 192.168.0.103, then you have :
    - Incoming port 8096 -> QNAP
    - Incoming port 22 (SSH) -> QNAP
    - Incoming port 8080 (web administration) -> QNAP
    - Other unsolicited incoming connections -> QNAP

  • Someone earlier mentioned OPNsense, which I use. Retail consumer-router DMZ is not the same as a properly isolated DMZ network implemented with a firewall like OPNsense. A real DMZ typically uses a separate network segment with carefully controlled access to the internal LAN.

• Disable UPnP on the router and automatic port mapping in Emby.

• Remove the existing manual forwarding rule and the automatic Emby UPnP mapping.

• Create a single manual rule forwarding TCP port 8096 to TCP port 8096 at 192.168.0.103.

• Save the configuration and restart the router.

Verify that you can access Emby locally using http://192.168.0.103:8096.  If that works, try accessing it from outside your LAN, like your phone with Wi-Fi disabled, using http://your.public.ip.address:8096. You should have your public IPv4 address from when you checked canyouseeme.org.

Whew, that was a lot! Let me just say that this is not how I accomplished remote access, but with your situation this should be enough to get you going.  I decided that my sanity was more important than money and I haggled a static IP address from my ISP and bought a domain from porkbun. The domain I chose was only $5.00 US a year.  Then I added Caddy to my "everything except emby" Portainer server. Caddy is (IMHO) by far the easiest reverse-proxy and Portainer makes docker configs super easy too.

 

 

[MrGiles 2]

Thanks for the detailed response marriedman.

I've checked the WAN IPv4 address in the hub's connection information, and this matches the address shown in canyouseeme.org, as well as matching the Emby dashboard WAN address.

Emby is not installed through Container Station on my NAS.

I've followed your troubleshooting suggestions and removed the existing port forwarding, disabled DMZ & UPNP, and created a new single port forward rule for TCP port 8096 to TCP port 8096 at 192.168.0.103

After re-starting the router, I can still access Emby on the local network, but still no success outside the LAN.

I remain baffled - I keep thinking I'm missing something obvious as Emby worked remotely for years until recently when I've changed ISPs.  I assume it must be some hidden setting in the router or the way the ISP operates.

[Luke 43402]

@sa2000

[sa2000 860]

On 17/10/2026 at 12:30, MrGiles said:

I've followed your troubleshooting suggestions and removed the existing port forwarding, disabled DMZ & UPNP, and created a new single port forward rule for TCP port 8096 to TCP port 8096 at 192.168.0.103

After re-starting the router, I can still access Emby on the local network, but still no success outside the LAN.

Looks ok 

You said you checked Remote Access is enabled on Emby Server. There are two places where that is set, Can you check both: in Network Settings and also on the user account

Did you eliminate CGNAT as a possibility ?   You can easily establish that by checking if the WAN Public IP address is within this range: 100.64.0.0 - 100.127.255.255

Now that you have manual port forward and uPnP disabled on the router, you can disable this Emby Server setting: "Enable automatic port mapping" - it should not matter but would be better 

Could you get a fresh screenshot of the router port forrwards screen

I have not had a virgin media super hub for a few years now - is the black status toggle on the port forward line showing that it is enabled or disabled?

 

 

 

[pwhodges 2120]

1 hour ago, sa2000 said:

Did you eliminate CGNAT as a possibility ?   You can easily establish that by checking if the WAN Public IP address is within this range: 100.64.0.0 - 100.127.255.255

I wonder how easy it would be for Emby to check this and pop up a message when trying to enable remote access.  A tracert to emby.tv and check the output for that range should do it.

Paul

Edited Monday at 04:37 PM by pwhodges

[MrGiles 2]

I've checked, and Remote Access is enabled in both locations

The WAN IP address is not in the quoted range, so presumably no CGNAT

I've also disabled the Automatic Port Mapping setting

The toggle status is 'enabled' when it's black on the Virgin hub - I've checked this, and it shows as greyed out if disabled.  New screenshot is attached

 

 

[sa2000 860]

Thank You. It looks perfect and it should work

Do you need to click on "Apply Changes" for it to be active?

Anything setup under Port Triggrting ? There shouldn't be any

Have you enabled "Secure Connections" in Emby Server Network settings on the QNAP?

We could see if the requests do reach emby server - by enabling debug logging in server settings / logs / settings and doing a test and then get the raw log file and send my by PM

So with debug logging enabled on your phone disable wifi and then in browser go to http://your-public-ip:8096

note down the time and outcome

you can use WinSCP to get the raw log file from Emby Server - the dashboard View Server Info button (via the ... next to the server name) will show the path to the logs

And you could also include in your PM these files - download then with winscp 

EmbyServer/programdata/config/system.xml

EmbyServer/programdata/data/wan.dat

 

[sa2000 860]

@MrGiles For the above test after you enable debug logging, best to restart the server before doing the test so i can see the startup network detection in the log. And do the test on the phone through cellular connection and the public IP:8096 url after you do a local network connection to the server from a local PC

Thanks

 

[Neminem 1958]

I just want to add to this.

There are more IP ranges that indicate CGNAT.