DNS-based Discovery/Access Only

Plex Media Server Remote Access
1

Is there a way to force all Plex clients to only access my server via a single domain? E.g. https://plex.foo.bar:443. I do not want any clients accessing it via IP:port, nor do I want this information to even be published externally; is this possible?

For reference, I have a split DNS config with a cloud-based CDN/WAF and internal HAProxy load balancer in place with the server running on my Kubernetes cluster. I’m having issues with some clients internal and external not being able to connect or connecting indirectly; some are fine though. I’ve noticed Plex publishes all the IP:port locations up to resources.xml, and also uses IP:port for external availability checks, even when I have a custom URL defined.

2

Don’t see how that is possible since DNS itself is simply a way to lookup the ip address and that DNS entry is public. So, when you access plex.foo.bar, the client issues a DNS lookup to the registry and finds out that the IP number for plex.foo.bar is xx.xx.xx.xx, all public information.

3

You’ve got a decent grip on how DNS works, but you’re ignoring some critical functionality with such a gross oversimplification of my problem: TLS SNI and host headers for HTTP, which are required for several things to function properly. Things like:

  • The cloud-based CDN/WAF
  • The HAProxy LB
  • TLS CN and SAN verification
  • The Nginx ingress on my Kubernetes cluster

Btw my Plex subdomain is not an A record that points to my WAN address as you assume, it’s a CNAME to my CDN/WAF provider, so the WAN IP isn’t exactly “public information”. My intent is to eventually just drop all inbound connections to port 443 at the firewall except those from my CDN/WAF provider, which isn’t an uncommon scenario for origins that employ such services.

I have many services hosted on 443 through the load balancer and the only things I have issues with are Plex clients because of how nonstandard the discovery/connection ritual is.

4

I see, way more complicated than I thought. Hopefully someone will have some ideas for you, it’s way over my paygrade. Good luck.