I gave up on port forwarding with my Jellyfin server, and remote streaming finally just works

Published Sep 1, 2026, 3:00 PM EDT Anurag is an experienced journalist and author who’s been covering tech for the past 5 years, with a focus on Windows, Android, and Apple. He’s written for sites like Android Police, Neowin, Dexerto, and MakeTechEasier. Anurag’s always pumped about tech and loves getting his hands on the latest gadgets. When he's not procrastinating, you’ll probably find him catching the newest movies in theaters or scrolling through Twitter from his bed. I’ve been trying to find the best way to remotely access my Jellyfin server, and after trying port forwarding, I can safely say that it doesn’t belong anywhere near my top five. On paper, you only need to open a port on your router and direct incoming traffic to the machine running Jellyfin. In practice, you have CGNAT, double NAT, changing public IP addresses, firewall rules, and the security risk of exposing your server to the internet. Some of these problems have solutions, but every solution adds another thing that you need to configure and maintain. I gave up before I could even make the whole setup work properly. I switched to Tailscale instead, and remote streaming finally just worked. Port forwarding comes with many challenges It's almost impossible to set up nowadays In theory, port forwarding only requires you to choose a port to forward to the computer running Jellyfin and then use your public IP address to connect from anywhere. But that comes with a lot of assumptions. For one, you need to control the entire route between the internet and your server, and that’s actively blocked by many residential connections. Even if you have the control sorted out, you still have to deal with the biggest roadblock: CGNAT. The ISP routes several customers through a single shared address. Incoming traffic reaches the ISP’s equipment first, and you cannot create a forwarding rule there. You can configure your router perfectly and still get nowhere because the connection never reaches it. The only conventional fix is to ask the ISP for a public IPv4 address, which may cost extra or be unavailable. You also need to deal with Double NAT, which commonly happens when an ISP-provided modem also acts as a router and you connect your own router behind it. Both devices perform NAT, so forwarding a port on only one of them does nothing. You need access to both routers, separate rules for each layer, or bridge mode on the ISP equipment. Getting through those problems still leaves several parts to maintain. The media server needs a reserved local IP address, so that the forwarding rule does not point to the wrong device. Most home connections also use dynamic public IP addresses, so you'll need dynamic DNS to keep a dependable address for Jellyfin. Tailscale handles remote access a lot better It comes with a lot fewer requirements Tailscale eliminates almost all the challenges you face with port forwarding. It creates a private network between the Jellyfin server and the devices I use for streaming. Both devices join the same tailnet, and Tailscale uses WireGuard to encrypt the traffic between them. Jellyfin remains accessible to my approved devices without putting its login page or streaming port on the public internet. Each device also receives a stable Tailscale IP address that remains the same even when the underlying network changes. You can also use MagicDNS to replace that IP with the server’s machine name, which is easier to remember. Tailscale tries to establish a direct peer-to-peer connection between the streaming device and the server. Once that connection is established, the media travels directly between the two devices instead of passing through a conventional VPN server. This keeps latency down and lets Jellyfin use the available upload speed from my home connection. If restrictive NAT or a firewall prevents a direct connection, Tailscale can fall back to a peer relay or one of its DERP relay servers. Setting up Tailscale with Jellyfin Definitely takes less time than setting up port forwarding I installed Tailscale on my NAS, which runs my Jellyfin server, and signed in with my Tailscale account. On Linux, connecting the server to the tailnet requires running the sudo tailscale up command after installation. Windows and macOS handle this through the Tailscale app. Once connected, the server appears under Machines in the Tailscale admin console, with a private IP address that begins with 100. Jellyfin doesn’t require a plugin or any special integration. The only setting worth checking is Allow remote connections to this server under Dashboard > Networking. Jellyfin also has a remote-access permission for individual users, so that needs to remain enabled for the account being used outside the house. The next part happens on the playback device. I installed Tailscale on my phone and the streaming device, signed in to the same tailnet, and connected it. Tailscale currently has clients for Android, iOS, Windows, macOS, Linux, Apple TV, and Amazon Fire devices. Android TV devices can use the Android app available through Google Play. Inside the Jellyfin app, I added the server using its Tailscale address followed by Jellyfin’s port, such as http://100.x.x.x:8096. There’s no need to configure an exit node, subnet router, Tailscale Funnel, or reverse proxy for this setup. Both the Jellyfin server and the playback device need only remain connected to the same tailnet. Tailscale normally starts automatically with the server, so the connection returns after a reboot without having to recreate anything.