Lock down the remote access port without losing remote capabilities?

Plex Media Server Remote Access
1

Server Version#: 1.26.2.5797-5bd057d2b
Player Version#: any

I was wondering if it’s possible to cause the port to be filtered/closed to all remote connections not coming from plex.tv?

So here’s the situation, I’m trying to lock down my network and make it harder to access. doing a pentest I discovered all the ports that were ‘open’ and have gone from one to the next and figured out how/why and closed them or got them filtered.

The one port I can’t seem to filter or close is the Plex remote access port (4XXXX). I see that it’s opened via NAT-PMP and that it’s needed for remote access.

I think it’d be alot better if it was filtered for access to the port to no IP but plex.tv, and then individually, connections made once logged into the website. In short, I don’t want to use the Relay function where Plex has to act as a middle man the entire time, but for the initial handshake, just to verify IPs and make connections, that way a random person can’t type my IP address and my ip and get a hit on a 443 or 80 type protocol.

2

Remote access is achieved by any remote Plex client contacting your server directly. It is not routed over plex’s cloud servers.
If you close it, no remote access is possible.

If you only want “relayed” access, disable the remote but leave “relay” connections enabled. It does exactly what you describe. But at a price: the bandwidth of a relay connection is limited. 1mbps for normal users, 2 mbps max for Plex Pass holders.