Server Version#: 1.40.4.8679
Player Version#: 4.135.2
Hello everyone !
Right now, my first ever Plex server isn’t accessible outside of my network. It seems i need to have a port fowarding/open to enable it, but i keep reading that doing so, open the door for hacking and security risks on my plex server/network, so now i’m a little bit affraid of even trying it. I have read that most suggest changing the port for the Plex server and not use the one by default, but other than that, i’m not sure what i should do and the risks associated.
Could you confirm me what are the risks associated to open a port ou fowarding one for a Plex Server on my router ?
Also, what should i do to maximize the security of my router/mac serveur if i do try the port fowarding ?
When you open a port to the public, you do increase your risk. In this case, with just the Plex port open, you are betting that Plex will not have a vulnerability that will allow a stranger to get in and rampage through your network.
People who run mail servers, web servers, security cameras, and other server apps are all making the same kind wager.
There is no way to guarantee that Plex will never have a vulnerability that will screw you, but overall they have a good record in this regard.
There are ways to further increase the security of a Plex setup like using a VPN or Tailscale and I am sure someone will explain that soon.
Changing the port number alone isn’t very helpful, though. Hackers scan massive ranges of ports and they are likely to find any kind of server wherever it is hidden.
So when i open a port, just the Plex server itself is at risk and not the computer or my network, unless the Plex software has a problem ?
After your message, i did some research for VPN or Tailscale, but i must admit that i dont understand much of it, but if i can upgrade a little bit the security of my setup, i’m always interested ^^. If you or someone could explain to me how to use that and what it does, i will be really grateful.
That’s correct. Only Plex is exposed. But if Plex really blows it and ships a bad security bug, then the computer with the Plex server could be taken over.
Plex has a good history in this regard, though here is an exception… A problem with the Windows version, years ago.
If I understand the material then the attacker ALSO needed access to the user’s Plex login token, so the attack required more than just the exposed Plex port, making this vulnerability hard to exploit in practice. (If I am wrong about that someone will be along to yell at me soon, this is the internet after all.)
Most people seem to be OK with exposing their Plex server directly to the Internet, but everyone has to make their own risk calculation.
Hello ! On my iMac for testing the server, after once, i didn’ need to enter my password again. Plex seems to have remember it, so that could be the risk ?
For a more “permanent solution”, i try to install the server on a old Mac Mini with Ubuntu, so i hope that should be enough. (if i’m able to install it…)
