# Plex Media Server and VPN **URL:** \ **Category:** Plex Media Server\ **Tags:** server-linux, sonos\ **Created:** [August 27, 2023, 6:37pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745 "2023-08-27T18:37:44Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [August 27, 2023, 6:37pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/1 "2023-08-27T18:37:44Z")
Server Version#: 1.32.5.7349-8f4248874 Player Version#: Plex for Sonos 3.0.0 I have PMS running on a Linux box using the Sonos app on my phone to stream music to the Sonos speakers. I also have VPN configured on my router. This setup did work fine … until now. I don’t know what changed, but now I have to disable VPN on my router to continue streaming music from PMS to the Sonos speakers. This is not an option. Some more symptoms: - Logging in via app.plex.tv I see the PMS and Sonos listed properly under _Authorized Devices_ - Logging in via app.plex.tv the PMS is listed as unavailable and cannot be configured - Logging in directly to the web interface of the PMS I can configure the settings of it - Under _Remote Access_ I can hit **Enable Remote Access** which seems to succeed displaying _Fully accessible outside your network_ but after 2 seconds changing to _Not available outside your network_. This was always like that, no change here really. - If I **Enable Remote Access** than on the Sonos app error message _Unable to browse music_ is displayed. - If I **Disable Remote Access** than on the Sonos app error message _No Plex Media Server available. Please make sure your Plex Media Server is accessible_ is displayed. It seems that **Enable Remote Access** is somehow required; why? All my devices are on the same LAN and I only want to stream my music when I’m connected to the LAN. But the main question is, why would VPN on the router needs to be disabled so that I can stream my music from the local PMS to the local Sonos speakers which are connected to the same LAN? Am I missing something? What changed? Why did this work fine in the past but now not anymore; is Sonos to blame or Plex? ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 2, 2023, 4:52pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/2 "2023-09-02T16:52:07Z")
Any input please from Plex? What relevant change is causing this after upgrading to version `1.32.5.7349`? Also, probably unrelated as this is happened even before the upgrade of the PMS, when logging into the PMS from any client, warning > Security Alert > Another device is attempting to sign in using your Plex account. You should only continue if you know this device and intend to grant it access. showing a wrong IP address is displayed. This seems wrong as well but I haven’t found a way to get rid if the warning. Anything the Plex guys could do on their end to reset this? Any pointers are very much appreciated. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [September 2, 2023, 7:06pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/3 "2023-09-02T19:06:24Z")
@thomas_5247 I looked at the log of IP addresses which your account has been using. While everything is Metro area, some are Fairfax County and other show as downtown in the district. Servers and devices have been Removed, Recovered, Added, and Deleted. - Remove / delete are what you can do in the GUI - Recovered happens when you restart the server after Removing it (the same ID numbers) - Added servers and devices are new to plex.tv What’s happening is Plex.tv is seeing access bouncing all over the place and raising the “Hey, this makes no sense. You got a security / password problem?” flag to you ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 2, 2023, 7:49pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/4 "2023-09-02T19:49:23Z")
I just did all three items, but it did not resolve the issue. What you see in the logs makes sense though, Metro area is what you would see when I have VPN on, Fairfax County with VPN off. The remove/recover/add I just did was done with VPN on. When the client is the browser I can stream music, the PMS is still not discovered from Sonos. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [September 2, 2023, 9:17pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/5 "2023-09-02T21:17:35Z")
The single most common problem is one of routing to Plex.tv Two important steps happen. 1. PMS reads the host’s config for gateway (modem/router) info 2. PMS queries the network (SSDP) to confirm there is a path to Plex.tv It then contacts Plex.tv directly through those IP addresses. Where things go awry with VPNs - 1. The “[whatsmyip.org](http://whatsmyip.org)” results (the exit IP) 2. The WAN IP at the modem/router don’t match. PMS is expecting them to be the same. The VPN throws it off. Requests do go out but Plex.tv has no WAN IP which it knows to reply to (the one from your modem/router) . Authentication fails. When the VPN is on the PMS server itself, the common technique is to create static routes to Plex.tv which bypass the VPN. You’ll see two techniques used: 1. A FQDN as the published server access URL for playback. (plex.tv uses this) 2. A static route to use for authentication. It’s unfortunate to be so messy ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 2, 2023, 9:30pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/6 "2023-09-02T21:30:57Z")
What is the role of `plex.tv` in my setup apart from registration of the devices? My PMS, the Sonos app on my phone, and the Sonos speakers are all connected to the very same LAN. Was there a change recently? ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [September 2, 2023, 10:04pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/7 "2023-09-02T22:04:24Z")
Plex.tv has always been central to the Plex design. Plex, and all its apps, are cloud based. All authentication is by plex.tv. ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 2, 2023, 10:47pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/8 "2023-09-02T22:47:43Z")
I also noticed that IP address returned by [whatsmyip.org](http://whatsmyip.org) does change frequently, several times within a minute. ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 2, 2023, 10:58pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/9 "2023-09-02T22:58:43Z")
> [@ChuckPa](#): > > All authentication is by plex.tv. Authentication doesn’t seem to be the problem, all devices I authorized are listed under _Authorized Devices_. Given the setup, nothing really explains why the browser client can access the PMS and stream content while the Sonos app cannot. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [September 2, 2023, 11:48pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/10 "2023-09-02T23:48:51Z")
This is really bothering me: > - Logging in directly to the web interface of the PMS I can configure the settings of it > - Under _Remote Access_ I can hit **Enable Remote Access** which seems to succeed displaying _Fully accessible outside your network_ but after 2 seconds changing to _Not available outside your network_. This was always like that, no change here really. > - If I **Enable Remote Access** than on the Sonos app error message _Unable to browse music_ is displayed. > - If I **Disable Remote Access** than on the Sonos app error message _No Plex Media Server available. Please make sure your Plex Media Server is accessible_ is displayed. this one bothers me the most: > - If I **Disable Remote Access** than on the Sonos app error message _No Plex Media Server available. Please make sure your Plex Media Server is accessible_ is displayed. Let me ask the obvious basic networking: 1. Are server and Sonos speakers on the same LAN subnet ? – For discovery to work without Remote Access, they must be on the same subnet. 2. If they are / should be, Are the Sonos wireless ? – If wireless, is the AP in “Wireless Isolation” mode? (AP isolation is the same thing as a firewall except in the AP itself) 3. Regarding Remote Access always failing, that will take a little more investigating but not too hard. Also, if the Linux firewall is enabled, have Plex’s ports been opened? ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 3, 2023, 12:23am UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/11 "2023-09-03T00:23:10Z")
> [@ChuckPa](#): > > - Are server and Sonos speakers on the same LAN subnet ? > – For discovery to work without Remote Access, they must be on the same subnet. Different subnets with port forwarding enabled for port `32400` to the subnet hosting the PMS. > [@ChuckPa](#): > > - If they are / should be, Are the Sonos wireless ? > – If wireless, is the AP in “Wireless Isolation” mode? > (AP isolation is the same thing as a firewall except in the AP itself) Wireless with _AP Isolation_ disabled. > [@ChuckPa](#): > > - Regarding Remote Access always failing, that will take a little more investigating but not too hard. Also, if the Linux firewall is enabled, have Plex’s ports been opened? No. Remember, the streaming to the browser on the same network as Sonos works just fine. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [September 3, 2023, 1:14am UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/12 "2023-09-03T01:14:13Z")
> [@thomas\_5247](#): > > Different subnets with port forwarding enabled for port `32400` to the subnet hosting the PMS. Insufficient. On LAN networks, without Remote Access enabled, you must have all the ports open/forwarded. This is why multiple LAN subnets is discouraged. (Broadcasts do not cross subnet boundaries) [https://support.plex.tv/articles/201543147-what-network-ports-do-i-need-to-allow-through-my-firewall/](https://support.plex.tv/articles/201543147-what-network-ports-do-i-need-to-allow-through-my-firewall/) You would need the ability to manually enter the server IP in the player / client for multiple subnets to work. I know AppleTV and Nvidia support this. I don’t know about Sonos. ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 3, 2023, 1:42am UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/13 "2023-09-03T01:42:38Z")
> [@ChuckPa](#): > > Insufficient. > > On LAN networks, without Remote Access enabled, you must have all the ports open/forwarded. Adding the additional ports gets me _Fully accessible outside your network_ but does not help with the original problem > [@ChuckPa](#): > > You would need the ability to manually enter the server IP in the player / client for multiple subnets to work. I know AppleTV and Nvidia support this. I don’t know about Sonos. Sonos allows to add external service plugins in the app, Plex is just one of many which I believe is provided by Plex itself; and it does not allow to specify a specific PMS IP address. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [September 3, 2023, 2:34am UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/14 "2023-09-03T02:34:18Z")
The only documentation I have about Sonos is this (emphasis on the modem/router hairpinning. [https://support.plex.tv/articles/218237558-requirements-for-using-plex-for-sonos/](https://support.plex.tv/articles/218237558-requirements-for-using-plex-for-sonos/) ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 3, 2023, 2:56am UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/15 "2023-09-03T02:56:29Z")
> [@thomas\_5247](#): > > > [@ChuckPa](#): > > > > Insufficient. > > > > On LAN networks, without Remote Access enabled, you must have all the ports open/forwarded. > > Adding the additional ports gets me _Fully accessible outside your network_ but does not help with the original problem Actually not. It seemed to work when I changed the `nftables` rules, but after rebooting, even with the new rules listed, it stopped working. ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 3, 2023, 7:32pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/16 "2023-09-03T19:32:25Z")
> [@thomas\_5247](#): > > Actually not. It seemed to work when I changed the `nftables` rules, but after rebooting, even with the new rules listed, it stopped working. The issue here was the `chain postrouting`. After removing that rule this worked, including after rebooting. Now I have consistently _Remote Access \> Fully accessible outside your network_ on the PMS, but when I go to `plex.tv` my PMS is still listed as not accessible. The same is true on the Sonos app, I’m still getting _No Plex Media Server available. Please make sure your Plex Media Server is accessible_. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [September 3, 2023, 7:51pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/17 "2023-09-03T19:51:35Z")
> [@thomas\_5247](#): > > Different subnets with port forwarding enabled for port `32400` to the subnet hosting the PMS. This is the fundamental problem. PMS and its apps are _ **NOT** _ networking smart. If you have multiple subnets for grouping – OK but there are adjustments needed. If you have multiple subnets for security – Give up now. Anyone/anything which gets on your LAN only needs to `nmap` and discover everything. I can’t remember how many times folks have built complex networks thinking it’ll make life easier when it’s been the exact opposite. Example: 1. Bulk of home network on 10.X.y.0 subnets 2. PMS on an isolated 192.168.x.x subnet In this case, EVERYTHING is **remote** from the server (based in IP addresses) even though it’s all on the local LAN. Here’s a thought and suggestion to consider: 1. On the PMS host, Increase the subnet width and make it wide enough to include the sonos speakers on those other subnets as part of its subnet mask. – By IP rules, this makes the Sonos speakers LOCAL. > [@thomas\_5247](#): > > Now I have consistently _Remote Access \> Fully accessible outside your network_ on the PMS, but when I go to `plex.tv` my PMS is still listed as not accessible. > > The same is true on the Sonos app, I’m still getting _No Plex Media Server available. Please make sure your Plex Media Server is accessible_. 1. I can now see that your Gentoo host has published itself at an IP address. 2. Go to LTE/Cellular mode and try connecting to your server. – this will allow you to confirm the port forwarding from modem/router → server is indeed working. Now I’m going to be a pain and ask “Why are the sonos speakers on a different subnet?” I really ask myself if you’re , without realizing, overthinking this. Plex is designed for the home, single subnet, operation. The more folks try to force it into weird / fancy configurations, the more it fails. Heck, I’m an ‘old fart’ (the dinosaurs and I were on a first-name basis 🤣 ), so you know my networking is simple. I have a single 192.168.0.x subnet. I don’t have any security cameras. there is NO WAY I need more than 253 device IP addresses. ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 3, 2023, 9:15pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/18 "2023-09-03T21:15:18Z")
Believe me, I tried to keep everything on the same subnet, precisely for simplicity. But this has it’s drawbacks too. I’m hosting Plex, and other servers, in a container. This is by design and generally works quite well, including with the PMS, until recently. > [@ChuckPa](#): > > Go to LTE/Cellular mode and try connecting to your server. Where is that? I cannot find it. > [@ChuckPa](#): > > Now I’m going to be a pain and ask “Why are the sonos speakers on a different subnet?” It’s the other way around. Everything is on the same subnet except the container hosting the web servers, including PMS. ---
**Author:** ![ChuckPa](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/chuckpa/32/79710_2.png) [@ChuckPa](https://forums.plex.tv/u/ChuckPa)\ **Post date:** [September 4, 2023, 5:24am UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/19 "2023-09-04T05:24:33Z")
I did some digging on the Sonos forum. Did you see this post ? > **[Changed UDP/TCP Ports for Sonos App needed after Update to S2? | Sonos Community](https://en.community.sonos.com/advanced-setups-229000/changed-udp-tcp-ports-for-sonos-app-needed-after-update-to-s2-6842454)** > > I have split my IoT Devices and Office Devices into two different VLANs. With now named Sonos S1 App, everything was running smooth and fine. Now, I had to make the update to Sonos S2 (the S1 app refused to connect to my Sonos devices!). After the... relevant info here are the UDP ports ---
**Author:** ![thomas\_5247](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@thomas\_5247](https://forums.plex.tv/u/thomas_5247)\ **Post date:** [September 4, 2023, 1:07pm UTC](https://forums.plex.tv/t/plex-media-server-and-vpn/851745/20 "2023-09-04T13:07:27Z")
Thanks for digging aound; I do have ports `32412-32414` already in the list of `nftables` forwarding ports on the host; currently I have all ports from `netstat -tunlp | grep Plex` listed in `nftables` for `chain prerouting`. I guess the following information from you is critical. > [@ChuckPa](#): > > You would need the ability to manually enter the server IP in the player / client for multiple subnets to work. I know AppleTV and Nvidia support this. I don’t know about Sonos. I think if I only could register the PMS with the host IP instead of the container IP things should work. This morning, without any changes, I suddenly got error _You do not have access to this server_. So I executed `./claimpms.sh` again. This time around, when the script asks me for the `IP Address of PMS server`, I entered the host IP address which then failed with ```auto ********ERROR******** We failed to get the Plex Media Server ID Please check server is up and running, as well as the IP address entered ``` The same script succeeds when I provide the container IP. But I would rather have the PMS registered with its host IP address as then `nftables` running on the host will take care of the port forwarding to the container. [Next page](https://forums.plex.tv/t/plex-media-server-and-vpn/851745.md?page=2)