My family stopped using my Jellyfin server for about a month, and the reason was embarrassingly simple. Nobody could remember 192.168.1.42:8096. My sister typed it three different wrong ways and gave up.
So I gave the server a real name. Something like watch.myhouse.net that loads with a padlock and no scary browser warning.
That is what a reverse proxy does. It sits in front of Plex, Jellyfin, or both, and forwards a clean domain name to the right internal address and port behind the scenes.
What a reverse proxy actually changes
Think of it as a receptionist for your NAS. A request comes in for jellyfin.yourdomain.com on port 443, the proxy reads the hostname, and it quietly hands that request to Jellyfin sitting on 8096 inside your network.
The visitor never sees the port. They never see the internal IP. They just get a normal-looking website with valid HTTPS.
The second win is security. Instead of forwarding ports 32400, 8096, and whatever else straight to each app, you forward only 443 to the proxy. One controlled front door instead of five open windows.
What you need before you touch anything
You need a domain name. A cheap one is fine, I pay around 10 to 12 dollars a year, and Cloudflare or Namecheap both work without drama.
You need your public IP to be reachable, or a tunnel that gets around that. If your ISP puts you behind CGNAT (common on some fibre and most mobile connections), plain port forwarding will not work and you will need a tunnel instead.
You also need a static internal IP for your NAS so the proxy always finds it. Set a DHCP reservation in your router using the NAS MAC address, and give it something memorable like 192.168.1.10.
Option A: Synology built-in reverse proxy
If you own a Synology, you already have a reverse proxy hiding in the menus. It is the fastest route and needs no extra containers.
Go to Control Panel, Login Portal, Advanced, Reverse Proxy. Older DSM versions tuck it under Application Portal instead, so poke around if the wording differs.
- Click Create and give the rule a name like Jellyfin.
- Under Source, set protocol HTTPS, hostname jellyfin.yourdomain.com, port 443.
- Under Destination, set protocol HTTP, hostname localhost, port 8096.
- Open the Custom Header tab, click Create, choose WebSocket. This one matters for Jellyfin, without it playback controls act glitchy.
- Save.
For the certificate, go to Control Panel, Security, Certificate, add a Let's Encrypt certificate for that hostname, then assign it to your new proxy rule under Settings. DSM handles renewal automatically after that.
Repeat the whole thing for Plex on port 32400 if you want a tidy Plex URL too. The Synology reverse proxy documentation covers the exact field names for your DSM version.
Option B: Nginx Proxy Manager for everyone else
If you are not on Synology, or you just want more control, Nginx Proxy Manager (NPM) is the friendly choice. It gives you a web UI on top of Nginx so you avoid editing config files by hand.
Run it in Docker. A minimal compose file exposes ports 80 and 443 for traffic and 81 for the admin panel, and you point it at a small database or the built-in SQLite. The Docker Compose documentation is worth a skim if compose files are new to you.
Once the container is up, browse to your-nas-ip:81 and log in with the default admin account. Change that password immediately, the default is [email protected] with password changeme, and bots know it.
Adding your first proxy host
- Go to Hosts, Proxy Hosts, Add Proxy Host.
- Domain Names: jellyfin.yourdomain.com.
- Scheme http, Forward Hostname the NAS internal IP, Forward Port 8096.
- Turn on Block Common Exploits and Websockets Support.
- On the SSL tab, request a new Let's Encrypt certificate, tick Force SSL and HTTP/2, agree to the terms, and save.
Give it thirty seconds. NPM validates the domain, pulls a certificate, and your clean HTTPS link goes live.
Point your domain at home
None of this works until DNS knows where home is. In your domain provider's dashboard, create an A record for jellyfin.yourdomain.com pointing at your public IP.
Home IPs usually change, so add a dynamic DNS updater. Synology has one built in under Control Panel, External Access, and most routers do too. Cloudflare users often run a tiny container that keeps the record current.
| Piece | Where it lives | Typical value |
|---|---|---|
| A record | Domain provider DNS | Your public IP |
| Port forward | Home router | 443 to proxy |
| Proxy rule | Synology or NPM | Hostname to internal port |
| Certificate | Let's Encrypt | Auto-renewing |
The mistakes that eat an afternoon
The classic one is forgetting WebSocket support. Everything loads, thumbnails appear, then playback stutters or the remote control buttons freeze. Flip that WebSocket setting on and it clears up instantly.
A second trap is the Plex custom access URL. Even behind a proxy, Plex needs its own domain listed under Settings, Network, Custom server access URLs, written as https://plex.yourdomain.com with no port. Skip it and Plex keeps advertising its raw IP to clients.
The third is a stale certificate because port 80 is blocked. Let's Encrypt validates over port 80, so if you only forwarded 443, renewal quietly fails months later and users hit a security warning. Forward both.
When port forwarding is off the table
If your ISP has you behind CGNAT, a Cloudflare Tunnel is the cleaner path. It makes an outbound connection from your NAS to Cloudflare, so no inbound ports are opened at all, and it hands you HTTPS for free.
You install the cloudflared connector, usually as a Docker container, point a public hostname at your internal Jellyfin address, and Cloudflare routes traffic through the tunnel. Note that Cloudflare's free plan discourages heavy video streaming through its proxy, so read the terms before you lean on it for a big library.
For most home setups with a normal public IP, though, plain port forwarding plus a proxy is simpler and faster.
Give it a name and forget the numbers
Once this is running, the payoff is quiet but real. You send someone a link that reads like a website, they click, they watch, and nobody asks you for an IP address ever again.
Start with one app, get the certificate and WebSocket bits right, then clone the rule for the next service. My whole stack, Jellyfin, Plex, and a photo app, now lives behind three tidy subdomains, and the setup took about an hour the first time and ten minutes for each addition after.
Frequently asked questions
Do I even need a reverse proxy for Plex?
Not strictly. Plex already offers secure remote access through its own plex.tv relay and matching certificate, so it works fine without one. A proxy is mainly worth it if you also run Jellyfin, which has no equivalent service, or if you want every app under one clean domain.
Why does my video play but the controls freeze?
That is almost always missing WebSocket support in the proxy rule. Both Jellyfin and Plex use WebSockets for live control and status updates. Enable the WebSocket or Websockets Support option in Synology's custom headers or in Nginx Proxy Manager and the problem clears up.
Is it safe to expose my NAS this way?
It is safer than raw port forwarding if you do it right. Forward only 443 to the proxy, keep the proxy admin panel local, and use strong passwords plus two-factor on Plex and Jellyfin accounts. The proxy becomes a single controlled entry point instead of several open ports.
What if my ISP uses CGNAT and port forwarding does not work?
Use a Cloudflare Tunnel. It makes an outbound connection from your NAS, so no inbound ports are needed, and it provides HTTPS automatically. Be aware Cloudflare's free plan discourages heavy video streaming through its proxy, so check the terms for large libraries.
How do I get the HTTPS padlock without paying for a certificate?
Use Let's Encrypt, which is free and automatic. Synology requests and renews certificates from its Certificate panel, and Nginx Proxy Manager does it from the SSL tab of each proxy host. Just make sure port 80 stays forwarded so the automatic renewal validation keeps working.
