How can I securely access Jellyfin remotely through Docker and Nginx Proxy Manager?
Asked by
MellowPine47
I'm new to Docker, Portainer, and running containers on a Synology NAS. Jellyfin and two other containers work correctly locally, but I can't access them from outside my network. I set up DuckDNS, configured the container parameters, forwarded ports on my router, and confirmed that the ports appear open with online port-checking tools. I can connect using a Windows script, but I don't want to leave a terminal window running constantly.
I also installed Nginx Proxy Manager and have been trying to obtain Let's Encrypt certificates. Certificate requests usually fail with an internal error, and even when one succeeds, the service still isn't reachable remotely through Docker. I've since removed the containers and run a cleanup command, so I'm starting over. I'd appreciate a beginner-friendly explanation of how to troubleshoot the networking, DNS, port forwarding, reverse proxy, and certificate pieces without making the setup more complicated than necessary.
Answers
Avoid changing several things at once. Start with one service and one hostname. Check that your DuckDNS record points to your current public IP, confirm the router forwards TCP 80 and 443 to the machine running Nginx Proxy Manager, and ensure the proxy host points to Jellyfin’s correct container address and port. Let’s Encrypt also needs to reach your server from the internet, so port 80 must be accessible during an HTTP challenge. If your ISP uses carrier-grade NAT or blocks inbound ports, normal forwarding won’t work even if local settings look correct.
Reply to this answer
This is probably a networking problem first and a Docker problem second. Strip the setup down and verify each layer separately: confirm Jellyfin works on the NAS’s local address, test the forwarded port from a genuinely different network such as a phone hotspot, and make sure the router forwards traffic to the NAS’s correct internal IP. After basic connectivity works, add the reverse proxy and HTTPS. Testing with a simple network utility from two separate networks can help determine whether the ISP, router, firewall, or container is blocking the connection.
MellowPine47: I’m still learning the networking side, so I’ll need to break that down into smaller steps. I didn’t realize I should verify the connection independently before involving the containers and proxy.
Reply to this answer
A purchased domain is optional; DuckDNS can work fine. A reverse proxy such as Nginx Proxy Manager is also enough for this setup, so switching to Traefik or adding a DNS server won’t fix the underlying issue by itself. Once external access works, split DNS through something like AdGuard Home can make the same hostname resolve to an internal address on your home network, but that is an optimization rather than a requirement for remote access. Also consider using a VPN such as Tailscale or WireGuard instead of exposing Jellyfin directly while you’re learning.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowPine47: That makes sense. I previously tried changing DuckDNS, Docker, the proxy, and certificates together, which made it impossible to tell where the failure was.