Plex through surfshark wireguard pfsense vpn
-
@jhmc93
Did some research, so yes you are right - it appears Plex does it's own encryption. No need for VPN.
So to access the plex server you are going to have to port forward the Plex server through the pfsense firewall (WAN) - you do this so it is prepared for incoming connections since pfsense will only open ports for outgoing traffic. When you do this I think pfsense will automatically generate the rule in the LAN.Firewall > NAT > Port Foward
If you have a dynamic IP from your ISP you can either see about getting a static IP or use a service like No-IP which insures your requests are routed correctly.
I believe after reading about the encryption by the Plex server you probably don't want Plex encryption pushed through the SurfShark VPN. No reason to attempt to use the SurfShark VPN gateway.
where I found my info:
https://www.reddit.com/r/PleX/comments/hbn6tr/server_question_do_i_need_to_use_my_vpn_or_not/ -
@The-Party-of-Hell-No see I want to use surfshark for other services,
with the port forwarding do I need to port forward my isp router to the pfsense one? I only have one public IP currently, all i'm trying to do is make plex accessible for other users as well as myself, but I also want to use the VPN for my other services, I know I can't use it for plex now from research. But I'm trying to setup a route to my Plex media server to run without surfshark access, my other services id run on different LAN IP's.
When I tried plex before through another user it said insecure error, so if I could run 1 IP not on surfshark and leave my other IP's for surfshark that would be good. But if I can't do that then thats ok. -
@jhmc93
1 - ISP router? do you mean the ISP modem? I assume you have a cable modem which the pfsense box is attached. In this scenario the outward public IP should be the one assigned to your WAN by your ISP. that would be your target IP for others routing to your pfsense to be port forwarded to the PLEX server. I would think Plex has an app for putting on a device to access remote plex servers. -
You can just set a firewall rule on LAN for the Plex server as source that has the WAN_GW set specifically.
-
@stephenw10 I Have tried this but I ain't getting internet connection from it.
@The-Party-of-Hell-No , My ISP is a router and modem in one, so I have a Pfsense connected onto that for additional security, I ask this as I have port forwarded on the Pfsense side but not on my ISP side and still no luck. -
@stephenw10
So, there does not need to be a port forward so incoming requests can route through the WAN? -
@jhmc93
OK, so now we have more complexity. Yeah, I was going from the perspective of a modem without router. So yes somehow you are going to, I assume, create a port forward for your modem/router to the pfsense LAN IP of your Plex server. Again you want the Outward/public IP of the ISP modem/router to be the target. Don't know beyond that because I don't have any info on the ISP modem/router. -
@The-Party-of-Hell-No I'm from UK, anyway here's my rules:
it says I have traffic going to the plex server but if I ping on the Plex server it doesn't say anything
-
Did you follow a guide for adding the surshark VPN? Did it have you remove the auto outbound NAT rule to prevent 'leaks'?
-
You don't need to obscure that 10.x.x.x private IP address. I assume that's the Plex server?
-
@stephenw10 that's the plex server, I followed this guide here,
https://www.ivpn.net/setup/router/pfsense-wireguard/
there's also another guide, trying to find it.Found it. Forget what I said above it was definitely this guide I used:
PFsense how to surfshark and wireguard.zip -
Yup so that's exactly what it has you do:
https://www.ivpn.net/setup/router/pfsense-wireguard/#firewallYou'll need to add an outbound NAT rule for the Plex server IP to the WAN address on the WAN. Otherwise it not be translated and cannot connect out.
-
Like:
Assuming 10.0.5.2 is the Plex IP. I would probably add an alias for it and then use that everywhere so you can change it in one pace if you need to.
-
@stephenw10 can you guide me on what I need to do then? Please as I’m new to pfsense. And all I seem to be doing is messing it up. The ip I’m using is a temporary machine so when I get the pfsense to bypass the vpn for Plex I can put it on my main thanks again
-
Your WAN IP doesn't matter. The NAT rule only has to reference the source as the Plex server IP.
So add a rule like I showed above.
What outbound NAT rules do you have currently?
You could just switch Outbound NAT back to Auto or Hybrid and the rules will match the traffic from the Plex server.
As I said in those VPN guides they have you remove the auto outbound NAT rues to prevent traffic from internal subnet leaving via the WAN directly. Here you need that to happen.
-
-
OK so you need to add rule on WAN for the Plex server IP as I showed above.
As an aside you should add a source for the Tailscale rule you have there. Having outbound rules with 'any' source can easily over-match traffic that should not be NAT'd like traffic from the firewall itself.
-
@stephenw10 said in Plex through surfshark wireguard pfsense vpn:
Having outbound rules with 'any' source can easily over-match traffic that should not be NAT'd like traffic from the firewall itself.
Like traffic from the WAN-address will be NATed to the WAN-address? I see, one can not invert that.
-
Yup, exactly. We have seen that break VPN tunnels from the firewall itself because it also randomises the source port.
-
@stephenw10 Thanks. I guess I have to write a Feature request.
