Locking down plex

General Discussions
1

Hey Everyone,

I’m super confused. I have a personal plex server behind a firewall. Originally I setup WAN access to LAN access Nat’d to the particular device that hosts plex on port 32400. This worked but today I blocked this rule and checked with family members, they could still access content. I checked things weren’t cached, logged in / out, restarted the plex server and they continue to have access. The only way to prevent access is to disable remote access in the settings.

Anyone know why it acts like this? Does any data get stored in the plex cloud? It doesn’t make sense that if I completely block people out from the firewall that they can still see content?

Edit: I forgot to mention the server has complete web access out but restricted access in.

Regards,
Richie

2

Plex does not store any of your server data / media – that’s all on your server.
Plex’ remote access is based on UPnP or a manual port forward – so if it’s still working that suggests your router is still allowing Plex to open that automated port mapping or you still have a manual port forward of some kind on that router of yours.

3

Thanks Tom, you see my setup is kinda different.

Router > Host > Virtual Firewall > Virtual Machine > Plex

The Virtual Machine hosting Plex has the firewall as its default gateway.

But somehow, strangely Plex still gets through. I checked the firewall and upnp is disabled. I’m probably missing something really obvious. If you have any ideas it would be greatly appreciated.

4

If you want to disable remote access to your Plex Server, then you should disable remote access in Plex. :slight_smile:

If remote access is enabled, Plex wants a port mapped in. You can configure one manually in your router/firewall, or you can let Plex try to establish one with UPnP. Plex tries hard to establish one with UPnP.

If Plex can’t get a port, it will still try to connect using the Plex Relay. That makes an outbound connection from the Plex Server to the Plex Cloud/Mothership. It’s like a bandwidth-limited VPN.

Settings → Network → Enable Relay

https://support.plex.tv/articles/216766168-accessing-a-server-through-relay/

But … are you trying to allow specific access?

5

Thanks Volts I appreciate the reply.

I would normally disable remote access from the Plex Server but I want to have control of the access from the Firewall just in case on a zero day attack on an outdated plex server for example.

If I specify a port will this over ride Plex trying to use UPnP?

I have now disabled relay as per settings above. Do you think this might fix the problem and will require the firewall to NAT a particular port to the vm?

Regards,
Richie

6

In Summary what I’m trying to do:

  • Allow remote access within Plex
  • Manage particular access from the Firewall by nat’n to a particular Plex port

In theory I could just go in and disable the Firewall rule to restrict access from the servers content instead of removing any Plex access / services from the user.

Edit: I have disable all WAN access from the firewall to the Plex VM, disabled relay in Plex. Plex server still has web access and users can still access content.

7

If you specify a port, Plex will use that port when it makes UPnP requests. I am not aware of a setting to fully disable UPnP messages when Remote Access is enabled.

If you disable the Plex Relay, have no port mapped to Plex, and aren’t running UPnP on your network, I believe that will “isolate” Plex.

8

Hmm Plex does say ‘Not available outside your network’ now but users still have access which is very strange.

9

Prove it. :slight_smile:

I mean that friendly and gently.

My first guess is that perhaps the Relay setting doesn’t change immediately, and a PMS server reboot might be in order.

My next long-shot guess is that existing firewall rules may not have been deleted, even if new ones are now blocked. I think that’s less likely.

If you play something from a client, what do you see in the Plex Dashboard now?

10

Thanks Volts

Resolution:
Disable Plex Relay, have a specific port mapped, make sure UPnP is disabled on the firewall

And the final important step that delayed me - restart the Plex server :slight_smile:

I can now enable / disable the firewall rule nat’d to that server which restricts access. No settings need to be amended within Plex now.

Thank for your help Volts and Tom. Tested several times and it looks to be resolved.

1 Like
11

Rebooting is offensive, I agree. :slight_smile:

1 Like
12

Your family. members may be seeing cached data on their computers. But instead of blocking at the firewall, how about blocking the users instead?

13

@ChuckPA might be worth asking the devs to add a restart is required note next to the relay tickbox in webui

14

Please clarify, in detail, what goes where, what it should do, and why this is needed?

( I need supporting information to write up a request for engineering so please help me out. )

15

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.