Plex indirect on many internal devices, but not all (Solved)

mervincm · Mar 9, 2019, 5:40 AM

For some time now I am seeing an issue with internal plex connections using the indirect option.
my main desktop works fine, both in chrome and in the plex media player.
from the Plex app in my IOS phone, or in my son's android phone, or even the Plex media player or the chrome web client in my macbook, they are always indirect. externally I have not noticed the issue at all.

I have always used the pfsense dns resolver, and I have the custom option server: private-domain:"plex.direct" configured

I do not have an additional router (ISP is fiber to stp on wan interface of pfsense system.

stephenw10 · Mar 6, 2019, 6:02 PM

Does it resolve on one of the clients that doesn't connect directly?

In indirect mode is the server streaming traffic out to a relay on the internet somewhere and then back in to your local client?
Not a Plex user myself.

Steve

johnpoz · Mar 6, 2019, 6:51 PM

You mean
private-domain: "plex.direct"

its plex.direct not plex-direct

So your wireless devices are all indirect? How do you have wifi setup in your network?

mervincm · Mar 7, 2019, 7:09 AM

@johnpoz said in Plex indirect on many internal devices, but not all:

You mean
private-domain: "plex.direct"

its plex.direct not plex-direct

So your wireless devices are all indirect? How do you have wifi setup in your network?

You are correct, this is what I have.
login-to-view

You are right, it is just wireless devices that are indirect. I confirmed that by enabling my wifi card on my desktop and sure enough, it connected indirectly, where it was always direct before. my MacBook Pro was connecting indirectly, plug in an ethernet cable and right away it swaps to nearby.

I can't explain why I didn't notice that... I will have a closer look at how my Ubiquiti gear is set up.

Ethernet adapter 10G:

Link-local IPv6 Address . . . . . : fe80::6541:b9a0:22ea:b99a%8
IPv4 Address. . . . . . . . . . . : 10.0.2.17
Subnet Mask . . . . . . . . . . . : 255.255.248.0
Default Gateway . . . . . . . . . : 10.0.0.1

Wireless LAN adapter Local Area Connection* 1:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Local Area Connection* 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wi-Fi:

Link-local IPv6 Address . . . . . : fe80::192f:36b6:f027:c7a1%21
IPv4 Address. . . . . . . . . . . : 10.0.2.16
Subnet Mask . . . . . . . . . . . : 255.255.248.0
Default Gateway . . . . . . . . . : 10.0.0.1

Nothing obvious here, same networks, same subnet mask.

I took a look at the wireless network config assigned in my cloudkey, nothing really stood out. any hints as to what areas to look at?

I can't think of any config in my pfsense that treats my wireless devices differently. I don't think ther would be a way for it to even know what was wireless and what was wired.

I can resolve the domain name plex.direct both on wire and on wifi.

johnpoz · Mar 8, 2019, 1:54 AM

Why are you using a /21? You have that many clients?

Whats the mask on the server? You don't segment your wireless - its the same network as your wired devices.

I would sniff on say your laptop - what IP is it actually connecting to?

edit: Here quick test you can do... In the dashboard on the server... Connect and play something - what does the server show for your IP? And what does it say your connection is? Remote, Indirect?

See here I turned off my wifi and connected and played something.. Im listed as remote

login-to-view

Then I connected to wifi and played something else, and you can see its a local address. And my wifi is even different segment than my server.. Server is on 192.168.9/24 and that specific wifi connected to is 192.168.7/24... And server says local vs remote..

I did edit on the server to list all of my local networks as local.. On the server, settings, network - advanced.. If left blank it will just be the network of your server.. Maybe mask is different on your server than on your clients?

mervincm · Mar 8, 2019, 5:45 AM

@johnpoz said in Plex indirect on many internal devices, but not all:

Why are you using a /21?
I use 10.0.1.0 -10.0.1.254 for one type of device, 10.0.2.0-10.0.1.254 for another type of device, and I have a reservation in DHCP for every permanent device in my home. Total about 40-50 devices
Too many to memorize but by the third group, I can at least tell what kind of a device it is at a glance.

What's the mask on the server?
Yes the nas is 10.0.0.11 / 255.255.248.0

At one point I just ran it as /8 but network scans took forever so I tightened it up to /21. This was the tightest I could go and still accommodate the range I had used. 10.0.7.x

You don't segment your wireless - its the same network as your wired devices.

Correct, it’s flat layer 2 segment
The only exceptions are I have a segment for open VPN connections (not plex server or clients on VPN)

And a segment created by docker for its containers (no plex servers or clients in docker, only a plex addon called tuallia)

I would sniff on say your laptop - what IP is it actually connecting to?
I can install ethereal and grab a capture. I should be able to filter based on source and seat and grab something reasonable sized

edit: Here quick test you can do... In the dashboard on the server... Connect and play something - what does the server show for your IP? And what does it say your connection is? Remote, Indirect?

It always says indirect for wireless clients there is a little badge they use to identify indirect.

See here I turned off my wifi and connected and played something.. I'm listed as remote

login-to-view

Then I connected to wifi and played something else, and you can see its a local address. And my wifi is even different segment than my server.. Server is on 192.168.9/24 and that specific wifi connected to is 192.168.7/24... And server says local vs remote..

I did edit on the server to list all of my local networks as local.. On the server, settings, network - advanced.. If left blank it will just be the network of your server.. Maybe mask is different on your server than on your clients?
I will confirm but I have the up selected that I use for the NAS it’s hosted on (not the ip for the mic not connected, or the mic for docker )

mervincm · Mar 8, 2019, 5:39 AM

I get the expected ips
here I have an IOS connection on a public ip, and its on LTE external to my network, so it is remote, and secure
I have an internal andriod phone on indirect :( 1 mbps because my that client is connected using my kids plex account and they are limited to 1mbps. no ip is listed for indirect connections.
and I have a plex web-chrome connected by wire and thus direct and secure
and lastly a plex web client connected by wifi and thus indirect. this under my plex account w plexpass and thus 2mbps
login-to-view

login-to-view

mervincm · Mar 8, 2019, 5:50 AM

@stephenw10 said in Plex indirect on many internal devices, but not all:

Does it resolve on one of the clients that doesn't connect directly?

In indirect mode is the server streaming traffic out to a relay on the internet somewhere and then back in to your local client?
Not a Plex user myself.

Steve

What do you mean does it resolve? do you mean plex.direct? if so it appears to resolve the same, and look the same in a web browser (ngix error screen) in both a wifi connected laptop and a wired desktop.

johnpoz · Mar 8, 2019, 7:39 AM

@mervincm said in Plex indirect on many internal devices, but not all:

10.0.7.x

/24 is all that is need for 10.0.7...

You sure its not using a PROXY?? Chrome loves to do that...

Your running plex in a docker? Yeah that nework is going to be behind a nat normally..

Do you know how to check what IP is being reported by plex.direct fqdn? Check what the server has for IPs

https://plex.tv/api/resources?X-Plex-Token=

login-to-view

You can get your token here
https://support.plex.tv/articles/204059436-finding-an-authentication-token-x-plex-token/

Yeah I run Tautulli as well - slick info!!! So your plex is not in a docker? I would check what it has for its network mask.. And validate what dns is being used by your clients..

Do you have AP isolation on? Can your wifi actually ping your plex server IP.. unifi it would be guest network. This is where wireless devices can not talk to wired devices.

Do you have required set for secure connections?

Take a look at your above info, we can see what is allowed for local and what is not, etc. If you have https required, but no https local that is viable? Just throwing out other ideas that could cause indirect.. But if it was the https thing I would think all your clients would do it both wired and wireless. But it could be whatever dns they are using have rebind protection, etc.

mervincm · Mar 9, 2019, 5:15 AM

@johnpoz said in Plex indirect on many internal devices, but not all:

@mervincm said in Plex indirect on many internal devices, but not all:

10.0.7.x

/24 is all that is need for 10.0.7...

I looked at this
https://www.dan.me.uk/ipsubnets?csrfmiddlewaretoken=MTU1MjEwMzU0MQ%3D%3D&ip=10.0.0.0
CIDR block IP range (network - broadcast) Subnet Mask IP Quantity
10.0.0.0/21 10.0.0.0 - 10.0.7.255 255.255.248.0 2048

You sure it's not using a PROXY?? Chrome loves to do that...

On my W10 system or MacBook, if I use the wired nic, then it's direct. as soon as I unplug the cat6 cable and use WiFi it swaps to indirect. In any case, I checked, and no proxy is defined in Chrome/Windows

Your running plex in a docker?

No Plex is running native Synology package. All I run in docker is TAUTULLI and NetData

Do you know how to check what IP is being reported by plex.direct fqdn? Check what the server has for IPs

This new to me!
when I view XML on a library file in plex web it has the correct IP address for my Plex server in the address bar.
in addition, when I do that view-source on my plex token (cool! it lists details on on my friends' plex servers here as well!)
my first line is like your picture, except my IP
<Connection protocol="http" address="10.0.0.11" port="32400" uri="http://10.0.0.11:32400" local="1"/>
my second one is quite different. yours is https, mine is HTTP again. yours is your internal fqdn, mine is my PUBLIC IP
<Connection protocol="http" address="mypublicip" port="32400" uri="http://mypublicip:32400" local="0"/>

Yeah I run Tautulli as well - slick info!!!

Yup, hey did you know this is an easy way to get your plex token? Settings, Plex Media Server, the bottom of the page.

So your plex is not in a docker?

nope

I would check what it has for its network mask

I checked in plex, only has IP, not mask. I didn't see it in Tautulli either, I confirmed the mask in my Synology, where it is set statically to 255.255.248.0

And validate what dns is being used by your clients..

Checked my PC, both the wired NIC and the Wireless NIC have a single DNS, my pfsense box running default DNS resolver mode.

Do you have AP isolation on?

I think so, but this is just wifi to wifi device I think. I will look into that. I have a ubiquti wireless setup. a cloudkey controller, and 4 APs all patched to date.

Can your wifi actually ping your plex server IP.
unifi it would be guest network. This is where wireless devices cannot talk to wired devices.

nope, no guest network, but there is a guest policy section in the main wireless network section. I will check that as well.

Do you have required set for secure connections?
prefered
Take a look at your above info, we can see what is allowed for local and what is not, etc. If you have https required, but no https local that is viable? Just throwing out other ideas that could cause indirect.. But if it was the https thing I would think all your clients would do it both wired and wireless. But it could be whatever DNS they are using have rebind protection, etc.

Thank you so much for all the pointers. I will continue to dig.

mervincm · Mar 9, 2019, 5:21 AM

It was the Ubiquiti Wireless network setting called guest policy!!!! uncheck that and my wifi devices now connect to plex directly!!!

Thank you so much again for all of the diagnostic advice, you led me right to it!!!!

There's a good reason that I have been running this software firewall for all these years, quality people and product!

johnpoz · Mar 9, 2019, 9:09 AM

Guest policy... Great to know!! Glad you got is stored.. prob much better streaming now with no buffer issues, etc..

As to why I have https://nas.local - that is prob because I setup its own cert, etc.. Signed with pfsense CA, etc. Not something you would need - but allows me to access it local with fqdn on https..

login-to-view

Yup, hey did you know this is an easy way to get your plex token? Settings, Plex Media Server, the bottom of the page.

Where exactly are you seeing this?

Your say you only have IP here?

login-to-view

You should prob put in your mask for your local network, if you vpn in, etc. etc. you would want your tunnel network(s) listed.. I just did it the easy way and put in rfc1918 space ;)

So why are you using /21 again because you use 10.0.0 - 10.0.7 for space? Why is my question? How many freaking devices do you have?? ;)

mervincm · Mar 10, 2019, 4:42 AM

@johnpoz
Where exactly are you seeing this?

login-to-view

10.0.0.0 - 10.0.0.254 for wired network gear/servers
10.0.1.0 - 10.0.1.254 for wireless network gear
10.0.2.0 - 10.0.2.254 for PCs
10.0.3.0 - 10.0.3.254 for phones/tablets
10.0.4.0 - 10.0.4.254 for media and gaming gear
10.0.5.0 - 10.0.5.254 for IOT gear
10.0.6.0 - 10.0.6.254 unused
10.0.7.100 - 10.0.7.199 DHCP scope for temporary / new / visitors

DHCP reservation for every permanent device in my home.
Total of about 75 devices
Too many to memorize but by the third group, I can at least tell what kind of a device it is at a glance.

Sorry in that location in plex I have my entire /28. I was referring to where you selected the IP in the preferred network interface

johnpoz · Mar 10, 2019, 9:04 AM

Ah in Tautulli interface - thanks.. Yeah that does make it easy to find ;)

that scope would all be great if you made them vlans and actually isolated them.. But if they are all on the same L2 kind of just meaning less.. And means you have to for sure hand out reservations for every mac address.