Sharing my Jellyfin server with family is harder than it needs to be, and VPNs are why

Published Oct 28, 2026, 8:30 AM EDT Gaming has been Samarveer’s greatest passion, and the Literature graduate in him takes immense joy in dissecting games for their themes, messages, and impact. Samarveer holds a deep appreciation of gaming, and considers the platform to be the most immersive and impactful across all media. He can be found engaging with gaming communities online, always ready to debate the finer points of ray tracing or itching to write an 8-page collegiate thesis on any game that impacts him emotionally. As someone who has self-hosted my media library through Jellyfin for a full year, I love how easy it's made it to build my own personal Netflix. However, I've also had to deal with remote access and networking, to the point that I even moved to Plex for a while before finally returning — problems that wouldn't exist if I just streamed movies on my living room TV. For most self-hosters, setting up a VPN is the obvious solution, which is exactly what I did with Tailscale to help my friends watch my movies and shows. The method is pretty straightforward and private, but the problem came up when I had to share my server not just with tech-savvy friends, but also my parents, living halfway across the country. That's when I realized the VPN method for sharing Jellyfin isn't necessarily what works best for everyone. I've found that the more people you want to bring into your Jellyfin setup, the more important it becomes to think beyond simply establishing a secure connection. Sharing Jellyfin through a VPN is easier than you'd think Tailscale makes remote access surprisingly painless A VPN is arguably the easiest way to share Jellyfin privately. Tools like Tailscale create an encrypted connection between your home server and remote devices, letting family members access your library without exposing Jellyfin directly to the internet. Once you get the hang of it, you install the software, configure access, and you're pretty much set. Unfortunately, that's where the simplicity ends. Getting started is relatively straightforward. Install Tailscale on the computer running Jellyfin, connect your family members' devices to the same network or share access to your server, and give them its Tailscale IP address or MagicDNS hostname. They can then enter that address, along with Jellyfin's port (8096 by default), into a compatible client to access your media library remotely. Your relatives still need a Jellyfin account — a username and password you create for them in the admin dashboard — to actually log in and watch. Connecting and logging in are two separate problems. Under the hood, Tailscale uses WireGuard to establish encrypted connections between devices. It tries to establish direct peer-to-peer connections where possible and uses DERP relays when network restrictions prevent that. Unlike a traditional WireGuard setup, you generally don't have to configure port forwarding yourself. It's a wonderfully elegant solution, but only if everyone's devices cooperate. Getting everyone connected is only half the battle For starters, when you share Jellyfin through a VPN, you need to make sure every device can connect to that virtual network. When I share it with my more tech-friendly friends, phones and laptops are never a problem, since Tailscale is on iOS, Android, Windows, and macOS, too. It's on Linux, too, but my friends who run Linux also happen to have their own Jellyfin servers — go figure. Smart TVs, however, are another story altogether. Many don't support VPN clients natively, which forces you to configure a compatible router or use an intermediary device to watch a movie. It's also particularly problematic when you have to walk your parents through installing and configuring a VPN over FaceTime. There's also the small matter of network configuration. Traditional VPNs like WireGuard may require port forwarding, firewall rules, and a publicly reachable endpoint. If your ISP uses carrier-grade NAT (CGNAT), incoming connections become considerably trickier. VPNs don't magically improve streaming performance. Your home upload bandwidth still determines how much data you can serve, while transcoding adds its own overhead. In a nutshell, this means you become an unpaid network administrator every time your friends or family need help reconnecting. Before you abandon the VPN, know what it was doing for you Keeping Jellyfin off the public internet matters I know it may seem like I'm using VPNs and talking about them as pure friction, but they offer something valuable: security and peace of mind. Jellyfin was never designed to be hardened against every threat on the open internet. Its unauthenticated API endpoints are among the reasons the project recommends against direct exposure — Jellyfin actually suggests a VPN or reverse proxy with additional access controls. A VPN sidesteps most of that risk by keeping Jellyfin off the public internet entirely. It ensures strangers can't just knock on your server's net-facing door; the only entrance is a private network connection. That's a rock-solid argument for continuing to use VPNs, and the alternatives aren't all that safer. However, for users who primarily use their TVs for streaming, and those who can't properly manage VPN clients, that security does come at the cost of convenience. Every alternative trades away some protection, making proper security configuration essential. A reverse proxy can make sharing Jellyfin much easier Give your loved ones a link instead of a networking headache If installing VPN clients on everyone's devices sounds like more trouble than it's worth, a reverse proxy is worth considering. Tools like Caddy let you expose Jellyfin through a domain name with HTTPS, so your family members can connect through their usual apps without ever joining your private network. As the host, you would still need to configure the proxy, secure the connection, and maintain an internet-reachable endpoint. Cloudflare Tunnel takes a different approach. Its software establishes an outbound connection to Cloudflare, letting you publish a hostname without opening ports on your router or requiring a publicly reachable home IP. That makes CGNAT considerably less annoying. Cloudflare tunnels also cost nothing on the free tier, and they include custom domains, DDoS protection, and no bandwidth limits. There is, however, an unavoidable cost: a domain name you'd have to buy for around $10 a year, since the tunnel routes a hostname on a domain (whose DNS Cloudflare manages). Cloudflare only handles reachability, though. In the bare-tunnel case, your friend or relative will have to do the least of any other option: they'll open the Jellyfin app, type the hostname, and log in with the account you made, without any Cloudflare account or VPN client. If you install Cloudflare Access as an auth layer, though, they will hit an identity-based login, which, sadly, tends to break the native TV experience (they can't complete a browser-based challenge). There are risks involved, though Thankfully, they are pretty easy to sidestep, depending on your choice There's another catch here, which, on paper, is a little bigger. Cloudflare restricts serving video through its standard proxied services on Free, Pro, and Business plans. Streaming your Jellyfin library through a public hostname can violate those terms, which means it's not the wisest decision to treat Tunnel as a free, unrestricted streaming solution. If you'd rather not take that risk, you have two options. If you're already on Tailscale, its Funnel feature can expose a single service publicly over HTTPS on a ts.net subdomain. Your friend won't have to install anything, yes, but this method isn't really built for sustained high-bitrate streaming. It's a convenience for the occasional remote viewer, but not something to build the server's backbone on. The other is a cheap VPS, a few dollars a month, running your reverse proxy (or a tool like Pangolin) as the public endpoint: it costs a little, but it sidesteps the Cloudflare terms question entirely and keeps your home IP hidden. Ultimately, a reverse proxy offers convenience, but it also makes your server reachable from the internet and requires careful security configuration. Tailscale remains an excellent option if your family's devices support it. The best remote-access setup is the one your family will actually use I'd be lying if I said self-hosting hadn't turned simple conveniences into little engineering projects. I started out wanting to watch a movie from another room, but now, I'm juggling DNS records, encrypted tunnels, authentication layers, and a friend who swears the TV was working perfectly fine yesterday. It's part of the charm, but only until it isn't. The freedom that Jellyfin prides itself on also means that there's no universal blueprint for sharing your library. If you're the only person using it, you can optimize for your own preferences. If you're sharing it with family, you can optimize for theirs, too. Jellyfin iOS compatible Yes Android compatible Yes Desktop compatible Yes Jellyfin is one of the best Plex alternatives you can get, and that's thanks to its open-source nature and powerful set of features. There are apps for basically every platform and it's completely free to run your very own server.