Disable creation of plex.direct registration entries

[_base04]

You can use UFW to block any incoming on the Plex port not coming from your reverse proxy

Note, you should have a plex.local.yourdomain so that local clients don’t unnecessarily route through the public IP

@hobeone

They ignored the custom URL and tried to connect to the plex.direct name which didn’t work because Plex was only listening on localhost:32400

not sure if it would fix this tho

@pshanew

But unless you’re MITMing these connections you’re still going to have to rely on Plex

Most reverse proxys terminate the SSL connection, inspect and reencrypt to the upstream server. Reencrypting on a localhost connection and/or a vlan isn’t really worth the overhead, unless it’s in the same LAN as the clients. The VLAN should be isolated from any other devices other than plex specific services.

@pshanew

But unless you’re MITMing these connections you’re still going to have to rely on Plex (or Tautulli, or something else) to see any real information about what they’re watching.

Most traffic inspection on reverse proxys is for error logging and security purposes like setting up a WAF or injecting CSP headers

@pshanew

Anyway, I’m just playing devil’s advocate here. I’m sure there are plenty of folks here who’d love this idea and I’m not necessarily against it myself. I just don’t particularly see the practical benefits of it.

I do agree that forcing everything all traffic through a reverse proxy induces another point of failure. Had a few instances where seemingly unrelated config changes would force local clients to route through the public IP (in my case behind a CDN).