How to set up Jellyfin remote access without port forwarding

Switching from Plex? Here's the honest comparison

Plex won its audience by making remote access painless, and it has been cashing that in ever since. In 2025 remote streaming itself moved behind a paywall, more features keep migrating to Plex Pass, and every play session still checks in with plex.tv even though the media sits in your living room. If one of those was your last straw, you are not alone.

Jellyfin hands all of it back. No account with anyone, no feature waiting to be paywalled, hardware transcoding included. The catch: remote access becomes your problem. The classic fix is port forwarding plus dynamic DNS plus a reverse proxy plus certificates, which eats a weekend when it goes well and is flatly impossible on CGNAT. A tunnel replaces that whole stack with one container. Your server dials out, and you get a permanent https:// address that works in every Jellyfin app.

What you need

• A running Jellyfin server. The OS doesn't matter: Docker, bare metal, Unraid, a NAS.
• One command's worth of access to that machine. You never touch the router.
• Enough upload bandwidth. 10 Mbps carries one 1080p stream; 4K wants about 35. Setup measures this for you.

Step 1: Create an account and pick a plan

Sign up, verify your email, pick a tier. You pay per server, not per device, so one plan covers the household:

• Basic: 20 Mbps for $4/mo. Fits one 1080p stream.
• Plus: 50 Mbps for $8/mo. Fits 4k stream or 2–3 concurrent 1080p.
• Pro: 100 Mbps for $15/mo. Fits multi-user households, 4k remux.

Throughput is the cap on our end. If your home upload is 12 Mbps, the 100 Mbps plan buys you nothing. Start small; changing plans later is two clicks in the billing portal.

Step 2: Run the agent on your server

After checkout you land on a setup page with your registration token already filled into ready-to-paste commands. The Docker one looks like this:

docker run -d --name tunnelo --restart unless-stopped \
  --cap-add NET_ADMIN --device /dev/net/tun \
  -v tunnelo-agent:/var/lib/tunnelo-agent \
  -e TUNNELO_TOKEN=YOUR-TOKEN \
  -e TUNNELO_JELLYFIN_URL=http://YOUR-JELLYFIN-HOST:8096 \
  ghcr.io/abiteman/tunnelo-agent:latest

Run it on the box that runs Jellyfin, or anything on the same LAN. Point TUNNELO_JELLYFIN_URL at wherever Jellyfin actually is — the machine's LAN IP (e.g. http://192.168.1.50:8096), not 127.0.0.1, which inside the container is the container itself. There's a curl | sh installer for bare metal and an Unraid template in Community Apps. Already running WireGuard on a router or NAS? Use the advanced mode instead: the agent stays unprivileged and hands you a wg-quick config for your own setup.

The agent only makes outbound connections, and the tunnel routes to your Jellyfin port and nothing else.

Step 3: Wait for the tunnel to connect

The setup page updates on its own, usually inside a minute. When it flips to Connected you get two things: your permanent address (your-name.tunnelo.app) and an upload speed test result. Pay attention to that number. It is the honest ceiling on your streaming, and knowing it up front beats debugging buffering complaints from the family group chat later.

Step 4: Point your Jellyfin apps at your new address

Open any Jellyfin app (Android TV, Apple TV, iOS, Roku, Kodi, a browser) and enter your https:// address as the server URL. Sign in with your normal Jellyfin account. Everything passes through unchanged, including the fiddly parts like seeking and websocket sessions that break on naive proxy setups.

Troubleshooting & FAQ