Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Plex through surfshark wireguard pfsense vpn

    Scheduled Pinned Locked Moved General pfSense Questions
    77 Posts 6 Posters 6.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • jhmc93J
      jhmc93 @stephenw10
      last edited by

      @stephenw10 apologies I thought your subnet was different to mine hence why I put the 24 in thanks, I’ll give it a go tomorrow and let you know how it goes

      1 Reply Last reply Reply Quote 1
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Yup it would be clearer if it showed an 'address' option there. Those rules are almost always used for larger subnets.

        jhmc93J 1 Reply Last reply Reply Quote 0
        • jhmc93J
          jhmc93 @stephenw10
          last edited by

          @stephenw10 so i got it to work. But I'm having this trouble at the moment:
          Screenshot 2024-05-22 175231.png

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            What is failing there?

            What is now working?

            How are you testing?

            jhmc93J 1 Reply Last reply Reply Quote 0
            • jhmc93J
              jhmc93 @stephenw10
              last edited by

              @stephenw10 so I allowed it in Nat outbound like you said. I also had to create a firewall rule to allow internet to be accessible and I’m running Plex, but my Plex ip says insecure where ssl is meant to be, so I don’t know if that’s normal???
              But I went on Plex.tv on my laptop and it showed the error above.
              But at the moment I’m on holiday and my Plex server is at home so my laptop is connected to Tailscale so I can work on my local IP’s at home.
              My Plex ip let’s me see my server just not working via the Plex.tv website

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Ah, so you are trying to connect to the Plex server from some remote location.

                So using the IP directly allows you to connect but shows as insecure? Dos it show a bad cert, like self signed?
                That seems like a setting in Plex. I don't run it I can't comment specifically.

                Using the app is it trying to access Plex over the VPN or dircetly? Via a port forward or some external relay?

                jhmc93J 1 Reply Last reply Reply Quote 0
                • jhmc93J
                  jhmc93 @stephenw10
                  last edited by

                  @stephenw10 I managed to get around it. I got a feeling my laptop that has a vpn was making it unsecured, or it may be a Tailscale issue. All I know is that the NAT record u helped me with is working perfect. If I cat ifconfig.me it replies with my ISP’s Public IP not the vpn. So thanks for your help. I don’t know if it a pfsense problem or if it’s because I haven’t port forwarded my isp router to the pfsense. But I still get remote access to enable it just says error. Could it be because my ISP router doesn’t have a port forward to the pfsense? Because the port forwarding rule is set for Plex in pfsense.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    If it does rely on a port forward then, yes, you would need that traffic to arrive at the pfSense WAN. So if you ISP router is still routing it too would need to forward the traffic.

                    I know @johnpoz runs Plex in all sorts of interesting configs so there's a good chance he could diagnose this in seconds if he's around.

                    jhmc93J 1 Reply Last reply Reply Quote 0
                    • jhmc93J
                      jhmc93 @stephenw10
                      last edited by

                      @stephenw10 see the idea was port forward pfsense but not my isp modem/router but if u need to port forward isp one to the pfsense then I’ll do it

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        I don't know if you do or not. I don't use Plex but I'm pretty sure it connects outbound to the Plex cloud servers and should allow accessing it via them. It may need to be configured to allow that for example.

                        It might rely on UPnP or be configured for that by default and that wouldn't work through two routers. Though I doubt @johnpoz would allow that. 😉

                        jhmc93J 1 Reply Last reply Reply Quote 0
                        • jhmc93J
                          jhmc93 @stephenw10
                          last edited by jhmc93

                          @stephenw10 I noticed it used upnp wen it was connected to my isp router, all I know is since I started pfsense, I can’t share it to other users at the moment

                          G 1 Reply Last reply Reply Quote 0
                          • G
                            Gblenn @jhmc93
                            last edited by

                            @jhmc93 Plex requires port 32400 to be forwarded for the secure connection to work.

                            jhmc93J 1 Reply Last reply Reply Quote 0
                            • jhmc93J
                              jhmc93 @Gblenn
                              last edited by

                              @Gblenn it is forwarded on pfsense, but my isp modem/router is not port forwarding to pfsense, so I’m wondering if that would be the problem

                              G 1 Reply Last reply Reply Quote 0
                              • G
                                Gblenn @jhmc93
                                last edited by

                                @jhmc93 Yes definitely, that would generally be a problem with any server or application that requires port forward.

                                Do you have to use your ISP's router at all? If your ISP only provides IP to a specific MAC address, you can always clone that and make pfsense look like it is the ISP router.

                                Otherwise, does your ISP router have something called "bridge mode" or "passthru mode"? If so, that will basically just pass on your public IP directly to WAN on pfsense.

                                If not, I'm guessing it should at least have DMZ, which essentially forwards all ports straight thru to pfsense. Preferably you should give pfsense a static IP since DMZ requires it to point to a specific IP on the ISP router LAN side.

                                Finally, if that is not available, you have to forward port 32400 to the IP of pfsense...

                                jhmc93J 1 Reply Last reply Reply Quote 0
                                • jhmc93J
                                  jhmc93 @Gblenn
                                  last edited by

                                  @Gblenn my ISP router is also my modem, so it’s gotta be running to provide my internet. Also my pfsense only has LAN ports but no WiFi access, so I use my WiFi devices on my ISP/ Modem router and my pfsense for my proxmox clusters that run my media servers.
                                  I can use DMZ on my isp/ router so I’ll set that when I get home from my holiday. As right now I can only access my pfsense and proxmox servers.

                                  G P 2 Replies Last reply Reply Quote 0
                                  • G
                                    Gblenn @jhmc93
                                    last edited by

                                    @jhmc93 Ah, so you are accessing pfsense remotely via your VPN? But then you should also be able to access your ISP router simply by adding it's IP range to the Allowed IP's list for your VPN client...

                                    jhmc93J 1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      High risk though if you get it wrong! 😉

                                      1 Reply Last reply Reply Quote 0
                                      • jhmc93J
                                        jhmc93 @Gblenn
                                        last edited by

                                        @Gblenn I’m using Tailscale to access my pfsense

                                        G 1 Reply Last reply Reply Quote 0
                                        • G
                                          Gblenn @jhmc93
                                          last edited by Gblenn

                                          @jhmc93 said in Plex through surfshark wireguard pfsense vpn:

                                          @Gblenn I’m using Tailscale to access my pfsense

                                          Ok same thing though, you need to add the IP of the ISP router to the subnet routers' allowed IP's.

                                          sudo tailscale up --advertise-routes=LAN-IP/24, ISP-router-IP/32 (or entire range)
                                          And make sure it's also "approved" in the admin console.

                                          jhmc93J 1 Reply Last reply Reply Quote 0
                                          • jhmc93J
                                            jhmc93 @Gblenn
                                            last edited by

                                            @Gblenn wouldn’t that be a security risk?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.