Emby Server Port Forwarding/Mapping Issue

[TurnerJo 0]

Hello Everyone,

The issue im having is i cannot access my emby server remotely. I can acces it via local ip address and on localhost. I have looked through the logs (see attached) and can see there is an issue with uPNP. so i have done the following as the emby guide says:

1) Manually added ports 80/443 to my routers port forwarding page.

2) Allowed ports 80/443 to be open on windows firewall and allowed embyserver program through as well. 

3) Checked DDNS service and no problems with that

4) Tried using DDNS url and manually using public IP address and both just time out.

Please can anyone point me in the right direction

Many thanks

 

 

embyserver.txt

[Abobader 3464]

Hello TurnerJo,

Please wait for someone from staff support or our members to reply to you.

It's recommended to provide more info, as it explain in this thread:

Thank you.

Emby Team

[Sammy 790]

Local http port should be 8096

Local https port should be 8920

Remote http port should be 8096

Remote https port should be 443

You also need an external domain name, a valid ssl certificate and a ddns server.

@cayars should be able to get you sorted.

Edited February 27, 2021 by Sammy

[GrimReaper 4740]

8 hours ago, TurnerJo said:

so i have done the following as the emby guide says:

1) Manually added ports 80/443 to my routers port forwarding page.

I seriously doubt that the guide recommends using those ports... 

[Carlo 4561]

50 minutes ago, GrimReaper76 said:

I seriously doubt that the guide recommends using those ports... 

What ports you choose to use are up to you but 80/443 or just 443 is likely the best choice. Any browser will use these two port as the default.  These two ports will work with any proxy or CDN service like Cloudflare that Emby default ports will not.  If using Alexa or Google Home and want to playback audio on the device itself 443 is a great choice.

In an update to Remote Setup that will cover some advanced topics these will be used as the default ports as they have advantages other ports don't have.

I agree with everything Sammy said above except the DDNS which you don't want with SSL but want a domain you control instead. So DDNS or Domain & SSL.

[GrimReaper 4740]

4 hours ago, cayars said:

What ports you choose to use are up to you but 80/443 or just 443 is likely the best choice. Any browser will use these two port as the default.  These two ports will work with any proxy or CDN service like Cloudflare that Emby default ports will not.  If using Alexa or Google Home and want to playback audio on the device itself 443 is a great choice.

In an update to Remote Setup that will cover some advanced topics these will be used as the default ports as they have advantages other ports don't have.

I agree with everything Sammy said above except the DDNS which you don't want with SSL but want a domain you control instead. So DDNS or Domain & SSL.

I actually always avoided 80 due to envisioning a lot of traffic going back and forth there, both outgoing and incoming requests, thinkin' it MIGHT create some time-out issues occasionally if used. Nice to learn it ain't so. 

[Carlo 4561]

Nah, nothing to worry about on that front.  Your router will take care of all of that.  Think about it.  Do you think you can't run a webserver or two in a small company along with 50 people all using ports 80 and 443 all day long.

The major advantage in general is http = port 80 and https = port 443 when no ports are specified in URs.  That makes it easy to just type your domain name in a browser and boom, Emby loads.

The downside to this as always is using KNOWN ports makes your server an easier target to identify via any remote port scan and port 80 is a default port to scan.  If you switched ports to something random in the correct range  then it's slightly harder to find this way as it won't show up in a scan only checking common ports but anyone doing a scan of all ports would stll find it.  Well worth the trade off IMHO.  But as always there is no right or wrong way to set this up. 

[TurnerJo 0]

6 hours ago, Sammy said:

Local http port should be 8096

Local https port should be 8920

Remote http port should be 8096

Remote https port should be 443

You also need an external domain name, a valid ssl certificate and a ddns server.

@cayars should be able to get you sorted.

The reason I used 80/443 is that is my routers default for http and HTTPS traffic.

I have tried with those ports and no luck, same issue.

I do have a external domain and valid SSL certificate and ddns, all three are working as intended so there's no issue there. The SSL certificate hasn't expired, the ddns has just been renewed and the domain points to the ddns

Any other suggestions?

 

 

 

[TurnerJo 0]

1 hour ago, cayars said:

What ports you choose to use are up to you but 80/443 or just 443 is likely the best choice. Any browser will use these two port as the default.  These two ports will work with any proxy or CDN service like Cloudflare that Emby default ports will not.  If using Alexa or Google Home and want to playback audio on the device itself 443 is a great choice.

In an update to Remote Setup that will cover some advanced topics these will be used as the default ports as they have advantages other ports don't have.

I agree with everything Sammy said above except the DDNS which you don't want with SSL but want a domain you control instead. So DDNS or Domain & SSL.

Thanks for the input however the reason I use both is that my isp is notorious for switching my IP address. I have recently moved house and this set up was working as intended before.

 

 

[Carlo 4561]

How are you using both a domain and ddns?

The cert is only going to work for the domain and not the ddns so it's important to know what the URL (domain) ends up being at the point of login.

[TurnerJo 0]

1 minute ago, cayars said:

How are you using both a domain and ddns?

The cert is only going to work for the domain and not the ddns so it's important to know what the URL (domain) ends up being at the point of login.

The URL is the registered domain name. The domain points to the ddns and the ddns says what my IP address is. The certificate works when you enter the domain URL into your internet browser and its accepts the certificate

This is not the main issue here, this system I have been using for over a year with no issue, I've recently moved house and now, not working. I just wanted to make sure I was doing everything correctly my end before I spend hours on the phone to my isp

 

[Carlo 4561]

Just curious.

So in a browser if you type your domain name in do you end up with your domain in the URL or the DDNS?
What kind of record are you using for your domain entry pointing to your Emby server?

Now more to your specific trouble.  If you go to canyouseeme.org is the IP the same as what Emby Dashboard shows you?
What happens when you run a port check from there?  What status does it show?

[TurnerJo 0]

1 minute ago, cayars said:

Just curious.

So in a browser if you type your domain name in do you end up with your domain in the URL or the DDNS?
What kind of record are you using for your domain entry pointing to your Emby server?

Now more to your specific trouble.  If you go to canyouseeme.org is the IP the same as what Emby Dashboard shows you?
What happens when you run a port check from there?  What status does it show?

You end up with the url. I believe it's just a cname entry on my domain side to point to xxxxxx.ddns.net or whatever it's called. But the user never sees that ddns part, just comes up as the original URL in their browser.

So emby dashboard has my URL as the external contact point. When I ping that URL using CMD it gives the correct IP address but gives me a response failed. I have also checked the ports and all of them are open. I have also manually check by typing my IP address in with he port number and still gives me an invalid response

[Carlo 4561]

OK so if you end up at xxx.ddns.net or whatever but that's not the domain  you setup in Emby. I can't see secure sockets working correctly in all clients if there is a redirect in place.

What does canyouseeme.org show for status when testing the IP/port you have exposed?

[Carlo 4561]

It's about 5am my time and I'm about to get a few Zs.

If you would like to do a remote session any time over the weekend I can help you and we'll find out specifically what the issue is with the new provider or setup.
If you want to do that send me an PM and we'll set this up.  Otherwise we can work through it in this thread.

Carlo

[TurnerJo 0]

Sure thing, i have a friend doing a remote session with me today, so if he is able to resolve it I'll post what we did here if not I'll message you, thanks for your help so far

[Carlo 4561]

Sounds great and best of luck to you and your friend!

[pwhodges 2012]

@cayarsSurely a DDNS service is merely providing an authoritative DNS name server for the name you provide it, which automatically is kept up to date as your IP changes.

As you can specify the nameserver for your domain to be other than that provided by your domain registrar there is no difference from the usual case.  So certification services will see nothing untoward in such a setup.

Paul

[Carlo 4561]

I just wanted clarity on the setup.  Most people don't refer to changing their own A or C records dynamically as DDNS (but technically it is) because it's a domain that's theirs.  DDNS these days is mostly used to talk about services like no-ip, ddns.net, asus, dnsomatic, etc that can get updated automatically with software or your router using an existing domain ran by someone else (but of course doesn't have to be).

So I was trying to get the distinction of what was setup.  I can't tell you how many times I've helped someone using a DDNS service (with a different domain) and the person has a registered domain but uses a redirect.  <-- This doesn't work with your own SSL cert.

I was originally thinking he was using a DDNS service (2nd thing I mentioned) which won't work, but instead appears to be doing the first and also what you were thinking Paul which of course will work since it's just a domain name with a mechanism in place to update a record.

I see all kinds of crazy setups so I was just asking.

[TurnerJo 0]

Hello everyone so I managed to figure it out. I had to change my HTTPS port back to 443. Then manually add the HTTPS port forwarding in my router (as an 'other' service rather than a HTTPS service) but even though emby says to use TCP I had to set it to TCP/UDP not just TCP on its own.i don't know whether it's intended to be this way or if I'm just being stupid but it works now except I can't connect via the domain (probably something to do with my routers DNS now allowing to connect back on its self). And also emby is working as intended that if someone tries to connect via http it will re route them to HTTPS. Thank you all for your help

[rbjtech 5284]

DDNS points to your domain name via a C-name record - that's a pretty normal setup.  That way you can use a free DDNS provider and point to your domain.  SSL works fine as it's the endpoint where the SSL is challenged, not the journey to get there.

[KLF&TLF 28]

@TurnerJo, did you get this sorted? If I have read enough you are in Australia using Telstra as well, I can't get mine to work is there any suggestions you can give me. I am NBN Telstra as well

 

[KLF&TLF 28]

@cayarsHi, sorry to reengage this thread but I cannot seem to get mine to work at all and when I try the above I end up not being able to use Emby at all.

In short my NBN provider (Telstra - in Australia) won't give me basic assistance and the router configure options don't seem to line up with what I need to do. I have attached the screenshots for my Port forwarding screen so any assistance would be greatly appreciated.

As you can see I use to use Plex but found that Emby goes a little bit further.

Thanks in advance 

[Carlo 4561]

Wrong section of router.  Set those setting back to defaults as you don't want to set route tables or routing.

Instead you want normal routing/switching with port FORWARDING.

You only want to forward port 8096 or 8920 to the Emby Server machine.
Which router is that? Looks familiar.

[KLF&TLF 28]

@cayars The router is a Gen 2 Telstra Smart Modem and the config page is really funky.

This is where I was when I first started this quest and in the process I locked myself out even when I was at home so deleted it all and threw my hands up in air. Now I have to go to hospital so want to take Emby with me so need to figure it out so I can watch both at home and while I am away.

This is the screen I added the 8096 into and then changed it to 8920 and I couldn't access Emby on anything other than the machine that controls the libraries.

If you can tell me what needs to be in these fields I will try again and see if I can succeed.

 

Thanks in advance