Connection to server issues - IP/FQDN Nearby/Remote/Indirect

PMS Version 1.9.7.4460 on Lan (Subnet Mask 255.255.255.0)

Wifi for PC 192.168.1.x
Ethernet for PlexMediaServer 192.168.1.y pms.mylocaldomain.net

If I use IP in browser for PMS I get my PMS as Nearby
If I use local DHCP DNS Address (my preferred method) in same browser I get my PMS as Remote
If I use Plex.TV launch I get Indirect

Can someone help me understand why all are not Nearby so I can find and correct the issue?

Side note in case related: I was unsuccessful getting manual remote port forwarding working since I switched ISPs & Router. I had manual configured on my previous router which was supplied by the ISP. I was able to add the UPnP service to my OpenWRT router now in use and it successfully registered the Plex forwarding request, PMS shows “Fully accessible outside your network.”

@ourcontact said:
Can someone help me understand why all are not Nearby so I can find and correct the issue?

Because the cryptographic certificate of the server doesn’t fit your custom domain name.

There is no real reason to use a custom local domain name for Plex. Just load the web app from http://plex.tv/web with a browser bookmark or a shortcut link. It’ll find your server(s) automatically.

Side note in case related: I was unsuccessful getting manual remote port forwarding working since I switched ISPs & Router. I had manual configured on my previous router which was supplied by the ISP. I was able to add the UPnP service to my OpenWRT router now in use and it successfully registered the Plex forwarding request, PMS shows “Fully accessible outside your network.”

This might be related to both your issues
https://forums.plex.tv/discussion/comment/1400116/#Comment_1400116

@OttoKerner said:
This might be related to both your issues
https://forums.plex.tv/discussion/comment/1400116/#Comment_1400116

Thanks, I always had Settings → Server → Network → Secure connections set to Preferred and that was still the case.
I did try changing from Preferred to Disabled and that immediately changed Remote to Nearby when using local FQDN.

BUT

That impacted plexTV → The server “_____” does not allow secure connections, although I could allow from there, didn’t this I wanted to do that.

Then I found "Settings - Web - General - ‘Allow Fallback to Insecure Connections’ = was set to “Never” instead of “on same network as server”.

Perhaps this got reset to Never on an update? Not sure when using the local FQDN started having these issues but all is basically good now.

As to why use this local domain name instead of plex.tv? Well I shouldn’t have to, but there was a level of perceived ease of use and understanding from others in the house. I have a webpage on port 80 that just does a redirect to 32400 and can send it to the IP instead of the name if I decide I want to try to enforce secure connections but it seems even using the IP doesn’t always end up secure, haven’t tracked that one down. Most of the time I get a check next to server using IP, but I did get a green lock at some point through all this testing IP vs FQDN.

I was still getting Indirect from Plex.TV even after changes above and restarting plexmediaserver and a fresh browser log in so I added plex.direct to the DNS Rebinding whitelist and that seems to have solved that issue.

Thanks for getting me started, there were a lot of cogs in this wheel, I don’t know if it was just the router change or if there was more coincidental changes that occurred, but all seems good now!

@ourcontact said:
Then I found "Settings - Web - General - ‘Allow Fallback to Insecure Connections’ = was set to “Never” instead of “on same network as server”.
Perhaps this got reset to Never on an update? Not sure when using the local FQDN started having these issues but all is basically good now.

This preference is stored in a Cookie in your browser. You might want to make sure this cookie “survives” a browser cache cleaning.

As to why use this local domain name instead of plex.tv? Well I shouldn’t have to, but there was a level of perceived ease of use and understanding from others in the house.

It only affects the use of plex web. All other types of Plex clients don’t require input of an URL.
And you can give your users browser bookmarks or shortcuts on their desktop as well
or change the URL on your intranet landing page to the one I gave you above. (this will also ensure that your users are always using the latest web app version)

it seems even using the IP doesn’t always end up secure, haven’t tracked that one down.

Using the IP won’t get you a secure connection, because the certificate is not valid for a private IP address. It is only valid for the subdomain on the plex.direct domain, your server gets assigned automatically as soon as it is started and connects itself to plex.tv

Also I am still getting Indirect from Plex.TV so I need to keep reading to try to see if there is something going on there.

‘Indirect’ is battled with the solutions I discussed in the thread https://forums.plex.tv/discussion/comment/1400116/#Comment_1400116

After making these configuration changes, you must restart
(in this order and with plenty of time inbetween)

  1. your router
  2. your Plex Server
  3. your clients

If you don’t restart, the changes won’t get into effect.

Changing the ‘Secure Connections’ preference requires also a Server restart, btw.

@OttoKerner said:

@ourcontact said:
Then I found "Settings - Web - General - ‘Allow Fallback to Insecure Connections’ = was set to “Never” instead of “on same network as server”.
Perhaps this got reset to Never on an update? Not sure when using the local FQDN started having these issues but all is basically good now.

This preference is stored in a Cookie in your browser. You might want to make sure this cookie “survives” a browser cache cleaning.

Don’t know what to say here, no browser cache has been cleared and it was an issue in multiple browsers as well as incognito mode, After I made the change all browsers had the change. Anyway it is good now and I know where to look if it happens again.

As to why use this local domain name instead of plex.tv? Well I shouldn’t have to, but there was a level of perceived ease of use and understanding from others in the house.

It only affects the use of plex web. All other types of Plex clients don’t require input of an URL.
And you can give your users browser bookmarks or shortcuts on their desktop as well
or change the URL on your intranet landing page to the one I gave you above. (this will also ensure that your users are always using the latest web app version)

Understood, “the bookmark” is my home LAN webserver page, don’t need more dang bookmarks :wink: I’ll think about changing the redirect, appreciate the advice.

it seems even using the IP doesn’t always end up secure, haven’t tracked that one down.

Using the IP won’t get you a secure connection, because the certificate is not valid for a private IP address. It is only valid for the subdomain on the plex.direct domain, your server gets assigned automatically as soon as it is started and connects itself to plex.tv

well it did… maybe some “magic” redirects going on in the background, but it appears to be locked sometimes when accessing via IP - see attached screenshot…

Also I am still getting Indirect from Plex.TV so I need to keep reading to try to see if there is something going on there.

‘Indirect’ is battled with the solutions I discussed in the thread https://forums.plex.tv/discussion/comment/1400116/#Comment_1400116

Got it, I had updated my post with the result of needing to whitelist DNS Rebinding.

After making these configuration changes, you must restart
(in this order and with plenty of time inbetween)

  1. your router

Nope, haven’t rebooted my router for days, able to add uPnP service, update whitelist, etc. no reboot necessary.

  1. your Plex Server

Maybe for something, I did a ‘service plexmediaserver restart’ once early on when testing, but I made scores of changes back and forth after that and most changes went into effect immediately.

  1. your clients

I did do a lot of browser reloads to see if anything changed.

If you don’t restart, the changes won’t get into effect.

Changing the ‘Secure Connections’ preference requires also a Server restart, btw.

I could make this change and see the results without me restarting the server, perhaps it is restarting itself.
(I am not using a Windows server if that matters)

Thanks again, your link in first post gave me all I needed, just took me a while to work through it all.