Server Sharing and Network Security 101 - Help Needed!

Server Version#: Latest BETA (Windows)
Remote Player Version#: Latest (Apple TV)

Apologies if this has already been covered elsewhere - unfortunately my searches so far haven’t found the articles that directly answer my questions. I have already read all the guides on the Plex website re Remote Access and Server Sharing.

I’m a Plex Pass member but am new to remotely sharing Plex servers. I am also currently using an Advanced Firewall as my router (which a friend helped me setup) hence my network setup is definitely more complex than the average. I’m a fairly advanced technical user however my knowledge of networking is not great when it starts to get to higher end of complexity (hence needing some assitance from friends and the web).

I would like to share my Plex server with a family member living outside my home network. I have a dynamic Public IP address assigned by my ISP (as does my family member whom I would like to share with).

I would like to enable sharing with them in the easiest way possible AND also not compromise my network security. What is the best/easiest way to achieve this?

At this stage, I have simply followed the steps (found here: https://support.plex.tv/articles/201105738-creating-and-managing-server-shares/ ) to share my server with them. They received the invite and can view my server’s name listed in their Plex client but they don’t currently see any of the libraries from server listed.

My concern is that, in order to get this working, all the guides out there on the web seem to indicate that the only way I’ll be able to share my server is by enabling Remote Access and then forwarding ports on my router to my Plex server. My concern is that, by forwarding ports, I’m effectively poking holes in my firewall and thereby creating a security risk for my network.

Is someone able to enlighten me as to whether my assumption that this is insecure is correct/incorrect and how I might go about sharing securely without creating a config nightmare for myself?

(my friend who is a networking expert, but not a Plex user, is saying that port forwarding is a very bad idea from a security standpoint and that the only way I should be doing this is by creating a private VPN between my family member and I. The issues I have with that is that it is (a) pretty complex, high effort and difficult for me to wrap my mind around how to actually do for both me and the family member, and (b) my family member just has a stock basic router provided by their ISP … so not exactly high-end in terms of functionality as far as I know).

Some things I’d like to understand …

  1. Is sharing possible without port forwarding?
  2. Do I have to enable “Remote Access” in order to share a library (or should simply Sharing the library work without needing to enable Remote Access) ?
  3. Are my only options here to either forward the ports or create a private VPN between myself and my family member (which seems pretty painful to get setup)?

P.S. In case it makes any difference and assists in pointing me in the right direction … currently I am unable to play the built in Plex extras for each of the Movies in my library (Plex tries to load/stream the content and eventually fails) … also … I’m currently unable to stream the built in Plex “News” videos. So in general I seem to not be able to stream any of the default Plex content. Not sure why these don’t work but that content hasn’t been that critical for me so I haven’t really done much to resolve to date. Note however, I am able to successfully match, download and update metadata for various shows and movies in my library so am not sure why I can’t stream the “default” content.

1 Like

That is how every “server” is working. You want a media server, you need an open port for this server. Period.

If you have a house and you want people to come in, you must unlock the door.

1 Like

In order for anyone outside of your local network to access anything on your server you have to have a port open for that traffic. If you enable remote access you’re not going to have to share your public IP with anyone as shared users will discover your server via plex.tv, so dynamip IPs don’t matter on either end.

1 Like

how much of a security risk is this realistically? should I actually be worried about it?

for example, is someone other than my family member able to access/“hack into” my shared plex server?

Or worse, by opening/forwarding that port, is hostile traffic able to get into my network and take unwanted actions on devices/operating systems other than my plex server?

apologies for the basic level of networking questions here

It will be able to get to Plex Server. If Plex Server has a vulnerability, it might be possible to exploit that.
On the other hand, if that would be possible, we’d have heard about it.
It’s, as all things in life, a weighing up of risks.

1 Like

how do I ensure that I only unlock the door for just the people I want to let in (and not leave the door open forever for just anyone to enter)? (again, pardon my networking ignorance)

plex.tv is taking care of that. Only authenticated users are allowed to access your server.

1 Like

Thanks for your replies.

So your view/understanding is that by opening the relevant 32400 port and forwarding it to the IP of my host machine (with Plex server on it)… any potential hostile traffic can only enter on that port and can only get to the Plex app itself on the host machine?

can’t get to other parts of the host machine (outside of plex)?

therefore only way to get into other parts of the host machine (other than plex server app) or into the rest of my network would be if Plex itself has vulnerabilities that are exploited?

Yes, yes and yes.

4 Likes

spoken like a true ninja :slight_smile:

At least you ask. Most people that get hacked don’t ask (themselves) these questions. Keep your windows server and plex updated (update when it asks you to) and use common sense (don’t open all ports / bypass firewall, don’t do stuff you don’t understand, etc…) and you should be fine. But 100% safe doesn’t exist.
If you bring it online you are responsible for everything it does.

1 Like

This topic was automatically closed after 90 days. New replies are no longer allowed.