Skip to content

Remote access

Only two things need to be reachable from outside the house:

Path For What's exposed
Router port forward → 32400 Plex remote streaming Plex only
Tunnel or reverse proxy (optional) Seerr, so friends can request from anywhere Seerr only
Same tunnel + identity gate (optional) Managing downloads from your phone qBittorrent WebUI, behind an extra login

Everything else (the *arrs, Portainer, Tautulli) stays on the LAN.

Plex remote access

  1. On your router, forward WAN TCP <plex_external_port> → <NAS_IP>:32400. Keep forwards to the minimum. (The external port can be 32400 or any other port; the real one is in the private runbook.)
  2. In Plex: Settings → Remote Access → Manually specify public port = the external port → Apply. It should show "Fully accessible outside your network".
  3. Turn Relay off (see Plex), so a failed direct connection shows up as an error instead of a silent 2 Mbps transcode.
  4. Keep the NAS and the main client on the same subnet, so local streams are switched rather than routed.

Seerr remote access (optional)

Seerr has its own Plex sign-in, so it is reasonable to publish it. A simple way that opens no router port is an outbound tunnel, for example a Cloudflare Tunnel:

  1. Cloudflare Zero Trust → Networks → Tunnels → Create tunnel (cloudflared), and run the connector container with ${TUNNEL_TOKEN} on the NAS.
  2. Add one public hostname: requests.example.com → http://<NAS_IP>:5055.
  3. Set Seerr's Application URL to https://requests.example.com.

Any other reverse proxy with TLS works just as well. Don't publish the *arrs or qBittorrent this way without an extra login in front.

qBittorrent remote access (optional)

If you want to check or add downloads while away, publish the qBittorrent WebUI through the same tunnel, but only behind an identity gate such as Cloudflare Access (Zero Trust → Access → Applications → self-hosted app for that hostname, with an Allow policy for just your email). Never expose it with only qBittorrent's own password.

  1. Add a public hostname to the tunnel: downloads.example.com → http://<NAS_IP>:8080 (the port gluetun publishes for the WebUI).
  2. Make sure an Access application covers that hostname before it goes live; an unauthenticated visit should redirect to the Access login.
  3. In qBittorrent → Options → WebUI, keep Host header validation and CSRF protection on, and add the hostname to Server domains if you've restricted that list.

Publishing the WebUI does not change how torrent traffic flows: it still leaves only through the VPN.