Force external Access onto specific Network IF

Plex Media Server Remote Access
1

Server Version#: 1.16.1.1246
Player Version#: Any

Team, All,
I utterly fail to get my Plex Server on Synology connected externally the way I want.
This is my (paranoid) setup (simplified):

                                             
                 +--------------+            
    +-------------  OpenWRT FW  |            
    |            |              |  +--------+
    |            | DMZ   SECURE |  |        |
    |            +--|-------|---+  | DS1819 |
    |               |       |      |        |
    |               |       |      |        |
    |               |       +------- LAN1   |
    |               |              |        |
    |               |              | LAN2   |
    |               |              |        |
    |               +--------------- LAN3   |
 +--|---------+                    |        |
 | DSL ROUTER |--------------------- LAN4   |
 +--|---------+                    |        |
    |                              +--------+
    |                                        
 INTERNET

Plex Server is running on the DS1819 Box.
I have all our private devices in the secure LAN segment.
I have some exposed devices in the dmz LAN segment.

I tried to give Plex Media Server the best possible upload speed by directly connecting it to my Internet Router, preventing Double-NAT etc.

I provided a Port Mapping Rule on the DSL Router, and it does work if I point it to another service on the DS box. But Plex does not answer – I get connection timeouts.

Checking the Server Settings in Plex I see that it expects external requests on the LAN1 subnet, I no work and no play made the Plex Server change it’s mind.

So, grudgingly, I now hat double-natted and double-Portforwarded Plex into my secure LAN1 zone. But I really would like to not do that and instead force the Server onto the LAN4 (direct) port for external (non-local) connections.

How do I do this?

Greetings,
–Thomas

2

Do you have Plex client devices in the ‘secure’ network segment?
If you do, then you should place your plex server there.

To make it accessible from the outside, create a portforwarding in both routers.
https://support.plex.tv/articles/200931138-troubleshooting-remote-access/

3

Otto, thanks!

Yes, I do have plex clients in the secure segment. Like our Laptops/Tablets.
And thus I need Plex Media Server to listen on LAN1. (I did verify Port 32400 is open on LAN4 because I can telnet there from the same network segment – so Plex is listening).

And it is accessible from the outside, because I have created a messy DSL Router -> OpenWRT -> LAN1@DS1819 port forwarding chain.

But I’d rather have a DSL Router -> LAN4@DS1819 chain … but Plex Media Server refuses to accept external network traffic on anything but LAN1.

I do not want to swap LAN1and LAN4 ports on the box because this would mean I’d have to change a lot of settings and rules inside the DS1819 box. I just want to tell Plex Media Server that the interface for the external connection is on eth3 (LAN4).

Am I making sense?
Greetings,
–Thomas

4

Why?
I don’t see a good reason for this. Even from a ‘security’ perspective.

And by puttin it onto LAN4, your internal devices may have no longer a direct connection to the server, leading to unnecessary transcoding. (and a NAS is not really suited for transcoding)

Have you tried to play with
Settings - Server - Network - ‘Show Advanced’ - “Preferred network interface”
?
(restart the server after changing it)

5

Hi Otto,

The why? question has a simple answer – which you give: NAS box is not suited for transcoding (not with what I run on the box anyway). Hence I want external connections to be as directly connected to the DSL router as possible, and still experience direct streams on local LAN.

Plex Media Server is listening on all local network interfaces. I see that using netstat -an | grep 32400.

Looking at the “Preferred network interface” setting, it says (in german) “Dieser Netzwerkadapter wird von lokalen Clients benutzt” which translates to “used for internal clients”. Regardless, I have changed it to LAN4 and it is still listening on all interfaces according to netstat.

Also, the “Fernzugang” setting still shows the LAN1 subnet, and Plex responds to internal connections on LAN4 but not on external. See also provided Screenshot:

08
Bildschirmfoto 2019-06-22 um 12.22.08.jpg761×575 151 KB

(The 10.x network segment is the secure one).

These are the results (with the Preferred network interface setting) for an external connection with only the target IP changed in the DSL Router:
13
This is clearly insane. The only change between those two telnets was changing the target IP for the Port forwarding. And the “Preferred network interface” in both cases was set to LAN4…

Hmmm.
Any thoughts?

Greetings,
–Thomas

6

Sorry, it doesn’t matter a single bit, if the external data stream is travelling over 2 portforwardings or just one. The CPU load on the server is exactly the same.

7

Maybe, maybe not. But there will be load on the intermediate Router, and there is a Port forward into the secure zone (which I simply do not want).

Neither routing (via 2 Port forwards) to LAN3 not routing (via 1 Port forward) to LAN4 works. Only breaching my secure network does the trick. :sob:

8

If I may provide some additional technical information here?

Engineering provided the means to move the http server portion of PMS to a specific adapter. The changes the IP address PMS listens on.

Engineering did not provide the means to select the ‘source IP’ when sending.

If this capability had been implemented, the network stack would have bound (bind()) the connection to the selected adapter and all traffic would flow through that adapter IP which I believe is the desired effect ?

9

This topic was automatically closed after 90 days. New replies are no longer allowed.