Cisco Umbrella (OpenDNS) block access to plex.direct

My company installed Cisco Umbrella on our PCs and plex is now unavailable. My company is really open to unblocking as long as the reasons are good enough: watching local TV while travelling abroad is good enough.

Only problem I have is that I am unable to find which URLs should all be unblocked for the system to work.

I assume plex.tv needs unblocking so does *.plex.direct (star needed to provide for all the great URLs the plex encryption generates). Am I missing something here / could somebody confirm?

1 Like

Those 2 would be a good start and plex.services -

*.plex.tv - app.plex.tv, plex.tv
*.plex.direct - dynamic direct device access
*.plex.services -

Ill check around and see if any others are needed.

Also can you confirm that if you try to ping or nslookup plex.tv it fails?

Also is this just a physical Plex Server you are trying to reach or a cloud based Plex?

Thanks for the answer!

plex.tv is working, I can reach the main website and logon.
*.plex.direct is one I asked for and they have allowed plex.direct. However the response I got is that they have no elegant way of allowing *.plex.direct.

I have not seen plex.services myself. Would you happen to know what it is used for? My goal is to watch my movies and watch TV. There is no need to do fancy webhooks etc.

@nokdim said:
Also is this just a physical Plex Server you are trying to reach or a cloud based Plex?
My plex installation is my own physical machine.

Since this is a Plex physical machine and not cloud you are gonna need *.plex.direct to connect to it -

In the background all Plex does is create a valid DNS and pre-pends to .plex.direct based on your Home Plex Server IP which changes so thats why *.plex.direct

Since you are running your own Plex you could look to setup a dyndns and eliminate this need and have 1 domain name.
You can use a free service like dynu or noip and get your own dynamic DNS setup so for example you could setup “SingleServingSociety.dynu.net” and give that to your IT department instead of *.plex.direct

I use DynDNS myself but I believe they do not have any free Dynamic DNS only paid for.

You will need to run a DYNDNS updater program of sorts (each site has their own client) on your Plex machine or some home routers can run this right on the router itself eliminating the need to run a program on your Plex machine.

Cool. Thanks for following up and sorry for the late reply: I have been traveling. I already run a dynamic dns.

I am wondering how that should work. I have the feeling plex web will connect to https://[hash].plex.direct URL. If my company blocks that, as they do right now, it will not be able to find my real DynDNS URL. In other words: browser connects to the hash and then gets a redirect to the DynDNS. If the first fails, the second will never happen.

To fix that I need to set that URL somewhere with plex, so they don’t connect to that hash, but to my “real” URL. I have not been able to locate that in my settings anywhere.

If I connect to https://my.domain.com:32400/web, I get a:
https://my.domain.com:32400/web uses an invalid security certificate. The certificate is only valid for *.d**********************.plex.direct

with no ability to continue.

Am I missing something?

With my DynDNS I just use http://domain.com:32400/ which eliminates the need for plex.tv which needs the hash.plex.direct

I do have this set on my side:

Also if you do use https:// and get an error you should be able to add an exception:
As your DYN domain will not match the cert.

See what you get…

Works in Safari, not in Firefox!

I understand that I can set my own certificate as well, thus fixing the complete issue. However, that will break functionality for some of my users (they will need to change URLs).

So this works as a great workaround for me! Thanks for that!

Hi!
I know it’s older topic, but some readers may be confused by implied wildcard:confused:

d* part is static(for this server) if I understand correctly so they can add it?