Remote Access on Linux

Setting Up Remote Access for Plex on Linux

Access your Plex media library from anywhere in the world with proper remote configuration on Linux.

Remote Access Overview

Remote access enables:

  • Mobile streaming - Watch on phones and tablets
  • Travel entertainment - Access your library on the go
  • Family sharing - Share with friends and family
  • Multi-location access - Stream at work, vacation, anywhere

Linux Network Configuration

Find Your Server’s IP

# Get all IP addresses
ip addr show

# Get primary IP
hostname -I | awk '{print $1}'

# Detailed network info
ip route get 1 | awk '{print $7}'

Configure Static IP

Netplan (Ubuntu 18.04+)

Edit /etc/netplan/01-netcfg.yaml:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses:
        - 192.168.1.100/24
      gateway4: 192.168.1.1
      nameservers:
        addresses:
          - 8.8.8.8
          - 8.8.4.4

Apply changes:

sudo netplan apply

NetworkManager (Fedora, etc.)

# List connections
nmcli connection show

# Set static IP
nmcli connection modify "Wired connection 1" \
  ipv4.addresses "192.168.1.100/24" \
  ipv4.gateway "192.168.1.1" \
  ipv4.dns "8.8.8.8,8.8.4.4" \
  ipv4.method "manual"

# Restart connection
nmcli connection up "Wired connection 1"

Firewall Configuration

UFW (Ubuntu)

# Enable UFW
sudo ufw enable

# Allow Plex port
sudo ufw allow 32400/tcp

# Allow Plex network discovery (optional)
sudo ufw allow 32410:32414/udp
sudo ufw allow 1900/udp

# Check status
sudo ufw status verbose

firewalld (Fedora/CentOS)

# Add Plex port
sudo firewall-cmd --permanent --add-port=32400/tcp

# Add discovery ports
sudo firewall-cmd --permanent --add-port=32410-32414/udp
sudo firewall-cmd --permanent --add-port=1900/udp

# Reload firewall
sudo firewall-cmd --reload

# Verify
sudo firewall-cmd --list-all

iptables (Direct)

# Allow Plex
sudo iptables -A INPUT -p tcp --dport 32400 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 32410:32414 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 1900 -j ACCEPT

# Save rules (Debian/Ubuntu)
sudo apt install iptables-persistent
sudo netfilter-persistent save

# Save rules (RHEL/CentOS)
sudo service iptables save

Port Forwarding Setup

Required Port

Plex needs TCP port 32400 forwarded from your router.

Router Configuration Steps

  1. Access router admin panel (usually 192.168.1.1)
  2. Navigate to Port Forwarding / NAT / Virtual Server
  3. Create rule:
    • Service Name: Plex
    • External Port: 32400
    • Internal Port: 32400
    • Internal IP: Your server’s static IP
    • Protocol: TCP

Verify Port Forward

# Test locally
nc -zv localhost 32400

# Test externally (replace with your public IP)
nc -zv YOUR_PUBLIC_IP 32400

# Or use nmap
nmap -p 32400 YOUR_PUBLIC_IP

Plex Remote Access Configuration

Enable in Plex Settings

  1. Open Plex Web: http://localhost:32400/web
  2. Go to Settings → Remote Access
  3. Check “Manually specify public port”
  4. Enter port 32400
  5. Click Retry to test

Verify Connection

A green checkmark means remote access is working. If not:

# Check Plex is listening
ss -tlnp | grep 32400

# Check process
systemctl status plexmediaserver

# View logs
sudo journalctl -u plexmediaserver -f

Dynamic DNS Setup

Using ddclient

# Install ddclient
sudo apt install ddclient

# Configure
sudo nano /etc/ddclient.conf

Example configuration for No-IP:

protocol=noip
use=web, web=checkip.dyndns.org/, web-skip='IP Address'
server=dynupdate.no-ip.com
login=your-username
password=your-password
your-hostname.ddns.net

For DuckDNS:

protocol=duckdns
use=web, web=checkip.dyndns.org/, web-skip='IP Address'
server=www.duckdns.org
login=your-token
password=
yourdomain.duckdns.org
# Start ddclient
sudo systemctl enable ddclient
sudo systemctl start ddclient

Manual DuckDNS Script

#!/bin/bash
# /usr/local/bin/duckdns-update.sh

DOMAINS="yourdomain"
TOKEN="your-duckdns-token"

curl -s "https://www.duckdns.org/update?domains=${DOMAINS}&token=${TOKEN}&ip=" | logger -t duckdns

Add to crontab:

*/5 * * * * /usr/local/bin/duckdns-update.sh

Reverse Proxy Setup

Nginx Configuration

sudo apt install nginx
sudo nano /etc/nginx/sites-available/plex
upstream plex_backend {
    server 127.0.0.1:32400;
    keepalive 32;
}

server {
    listen 80;
    server_name plex.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name plex.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/plex.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/plex.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://plex_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_redirect off;
        proxy_buffering off;
    }
}

Enable the site:

sudo ln -s /etc/nginx/sites-available/plex /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

SSL with Let’s Encrypt

# Install certbot
sudo apt install certbot python3-certbot-nginx

# Get certificate
sudo certbot --nginx -d plex.yourdomain.com

# Auto-renewal is configured automatically
sudo certbot renew --dry-run

VPN Configuration

WireGuard Setup

# Install WireGuard
sudo apt install wireguard

# Generate keys
wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod 600 /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

Server configuration (/etc/wireguard/wg0.conf):

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32
# Enable WireGuard
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Bandwidth Management

Limit Remote Streaming

In Plex settings:

  1. Settings → Remote Access
  2. Set “Limit remote stream bitrate”
  3. Configure based on upload speed:
    • 10 Mbps upload → 8 Mbps limit
    • 50 Mbps upload → 40 Mbps limit

Traffic Shaping with tc

# Limit Plex bandwidth to 50Mbps
sudo tc qdisc add dev eth0 root tbf rate 50mbit latency 50ms burst 10kb

# Remove limit
sudo tc qdisc del dev eth0 root

Troubleshooting

Debug Remote Access

# Check port binding
sudo ss -tlnp | grep 32400

# Test from inside network
curl -I http://localhost:32400/identity

# Check NAT
sudo conntrack -L | grep 32400

# View Plex logs
tail -f "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Logs/Plex Media Server.log"

Common Issues

Double NAT

# Detect double NAT
traceroute plex.tv | head -5
# Multiple 192.168.x.x or 10.x.x.x addresses = double NAT

ISP Blocking

# Test if ISP blocks port 32400
# Try alternative port in Plex settings
# Forward different external port (e.g., 443) to internal 32400

Security Considerations

Fail2ban for Plex

sudo nano /etc/fail2ban/filter.d/plex.conf
[Definition]
failregex = .*\[Req#.*\] \[Auth\] Failed to authenticate client at <HOST>.*
ignoreregex =

Add to jail:

sudo nano /etc/fail2ban/jail.local
[plex]
enabled = true
port = 32400
filter = plex
logpath = /var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Logs/Plex Media Server.log
maxretry = 5
bantime = 3600

Next Steps

With remote access configured:

  1. ✅ Test from mobile network
  2. ✅ Configure Plex apps on mobile devices
  3. ✅ Share with family members
  4. ➡️ Continue to Advanced Configuration

Stream your media from anywhere in the world!