Plex through surfshark wireguard pfsense vpn
-
Your WAN IP doesn't matter. The NAT rule only has to reference the source as the Plex server IP.
So add a rule like I showed above.
What outbound NAT rules do you have currently?
You could just switch Outbound NAT back to Auto or Hybrid and the rules will match the traffic from the Plex server.
As I said in those VPN guides they have you remove the auto outbound NAT rues to prevent traffic from internal subnet leaving via the WAN directly. Here you need that to happen.
-
-
OK so you need to add rule on WAN for the Plex server IP as I showed above.
As an aside you should add a source for the Tailscale rule you have there. Having outbound rules with 'any' source can easily over-match traffic that should not be NAT'd like traffic from the firewall itself.
-
@stephenw10 said in Plex through surfshark wireguard pfsense vpn:
Having outbound rules with 'any' source can easily over-match traffic that should not be NAT'd like traffic from the firewall itself.
Like traffic from the WAN-address will be NATed to the WAN-address? I see, one can not invert that.
-
Yup, exactly. We have seen that break VPN tunnels from the firewall itself because it also randomises the source port.
-
@stephenw10 Thanks. I guess I have to write a Feature request.
-
@stephenw10
So I don’t need to do anything with my NAT outbound rules?
I Tried creating a nat rule for Plex IP but it just defaults to 192.168.0.0 -
You need a add a rule like I showed in my example where the source is set to the Plex server IP address.
You could set the source to the full LAN subnet but I'm assuming you don't want any other LAN side hosts to be able to use the WAN directly.
-
@stephenw10 I did what you said but when I add my Plex server ip address for eg. (192.168.0.90) and I save it, it changes back to 192.168.0.0
-
I assume your Plex server is actually 10.84.62.X?
What are you setting that keeps switching back to 0.0?
You should be setting the source like so:
-
@stephenw10 is there a way I can send a small vid on here to show you?
-
You can upload it here: https://nc.netgate.com/nextcloud/s/iRCYoGnH6KsMrXR
-
@stephenw10
Uploaded the video -
You have to set the subnet to /32 for a single host like in my screenshot above.
-
@stephenw10 apologies I thought your subnet was different to mine hence why I put the 24 in thanks, I’ll give it a go tomorrow and let you know how it goes
-
Yup it would be clearer if it showed an 'address' option there. Those rules are almost always used for larger subnets.
-
@stephenw10 so i got it to work. But I'm having this trouble at the moment:
-
What is failing there?
What is now working?
How are you testing?
-
@stephenw10 so I allowed it in Nat outbound like you said. I also had to create a firewall rule to allow internet to be accessible and I’m running Plex, but my Plex ip says insecure where ssl is meant to be, so I don’t know if that’s normal???
But I went on Plex.tv on my laptop and it showed the error above.
But at the moment I’m on holiday and my Plex server is at home so my laptop is connected to Tailscale so I can work on my local IP’s at home.
My Plex ip let’s me see my server just not working via the Plex.tv website -
Ah, so you are trying to connect to the Plex server from some remote location.
So using the IP directly allows you to connect but shows as insecure? Dos it show a bad cert, like self signed?
That seems like a setting in Plex. I don't run it I can't comment specifically.Using the app is it trying to access Plex over the VPN or dircetly? Via a port forward or some external relay?
