I am in love with my Jellyfin server (running in a Docker container) - it feels so nice to take back control over my media consumption again, after more than a decade in the land of streaming. So much, that I want to share this with my family.
So I was thinking of setting up a reverse proxy (Nginx Proxy Manager is what I have used before) and expose my Jellyfin-instance through that. However, I’ve seen several people be skeptical about this solution, instead opting for access through a VPN (I don’t think that would be a good solution for some of my family members).
What are the potential pitfalls of setting it up this way, that makes people skeptical? Where could I go wrong, and what dangers would I expose myself to? As I understand it, this would only expose one port to the internet, direct all that traffic to the Nginx Proxy Manager, which then forwards traffic to specific ports internally on my home network, which sounds safe in my mind. Is it misconfiguration of the proxy manager I should be wary of? Or some exploits in the proxy manager?
They most definitely do. Some people get some sort of sick joy out to of being a PITA. I’ve had it happen to me. You’re very unlikely to become the target of a DDOS (distributed DOS) attack since that takes a lot more effort to execute successfully and there’s no payoff in this situation. But, isolated DOS attacks are more common than you might think. Whether you can defend against one depends on how much bandwidth you have but probably more on the firewall you’re running. If you have a WAN facing firewall capable of detecting and dropping connection attempts that follow a malicious pattern without choking, you’re probably not gonna have a lot of issues if any.
The level of obscurity also helps minimize your likelihood of becoming a target. Just keep your servers and any device firmware up to date.
These are just some risks you might run into. I wouldn’t necessarily consider them showstoppers. Just things to be aware of what could happen, not necessarily will and try to take preventative measures. To be honest, you’re probably going to get more trouble from your relatives than you will from a malicious actor.
I think I equated denial-of-service with DDOS, and didn’t consider isolated DOS attacks. Makes sense that there are people who would do that for kicks and giggles. I’ll look into what protection options I have on my router firewall. There were some suggestions below on keeping a strict IP whitelist policy, which if implemented successfully would lower the risk of any such attack at least. I am just imagining that it might be quite a hassle maintaining such a policy, at least in the beginning.
Hehe, it is hopefully too many I will share this with, so I hope the burden won’t be too big.