Look into Tailscale. Its free
Comment on How do I host Jellyfin in the most secure manner possible?
Charger8232@lemmy.ml 4 weeks agoI wish it were that simple, but as I mentioned that would require paying for ProtonVPN to allow LAN connections (which isn’t the worst thing in the world, but I’d prefer to avoid subscriptions where possible) and clients don’t allow self-signed certificates.
tacostrange@lemmy.ml 4 weeks ago
DesolateMood@lemm.ee 4 weeks ago
Idk if proton allows you to download config files on a free account but if they do then you could use those to manually split tunnel your local internet
Charger8232@lemmy.ml 4 weeks ago
Idk if proton allows you to download config files on a free account
I remember a time a few years ago when I managed to do something similar… I’ll look into this!
smiletolerantly@awful.systems 4 weeks ago
What are you talking about. Please clarify if this is actually true:
This would mean that you only want to access Jellyfin when you, and the device you are watching your show/movie on, are at home, where the Pi/server also is.
Is this correct?
If so, then questions about VPN, Certificates, DNS,… do not matter.
Now you can access it at home, and only at home. I honestly fail to see where a VPN would even come into the equation here (again, if you wish to ONLY watch when you are at home, as you’ve said).
DesolateMood@lemm.ee 4 weeks ago
OPs problem is that proton blocks Lan connections when connected and require you to pay them if you want to unblock it
smiletolerantly@awful.systems 4 weeks ago
Smh. I get wanting to be connected to a wifi, but being locked out of your own local network is just stupid.
lefixxx@lemmy.world 4 weeks ago
What the f
littleomid@feddit.org 4 weeks ago
Then he should use Mullvad.
Charger8232@lemmy.ml 4 weeks ago
Yes.
They do, because if ProtonVPN blocks LAN connections then the only other option is exposing the server to the WAN
This does not encrypt during transit, and my network is not a trusted party.
I, like many others, use my devices for more than just accessing my LAN while I am on my home network.
smiletolerantly@awful.systems 4 weeks ago
Then honestly, you have other problems than setting up Jellyfin.
For real though, if you think someone is (or might be) listening in on your local network, i.e. have physical access or compromised one of your machines, then the Jellyfin traffic is the least of your problems. Pick your battles. What’s the worst that could happen here - someone gets to know your favorite show?
Ah, I see. On your PC you should just be able to set a static route over the physical interface for 192.168.0.0/24 (or whatever your local network is) which takes precedence over the VPN. For android… Oof, no idea. Probably need root.
Charger8232@lemmy.ml 4 weeks ago
A bad router + bad ISP combo means I get ratted out for copyrighted material (that I don’t have… I only host creative commons videos on my Jellyfin server, of course…)
skizzles@lemmy.world 4 weeks ago
Charger8232@lemmy.ml 4 weeks ago
Part of my threat model is essentially “anything that can connect to the internet poses a security risk”. Since networks are the literal gateway to the internet, it is reasonable not to trust them. Routers don’t run as secure operating systems as Qubes OS, secureblue, or GrapheneOS. If a malicious party found a way to connect to the network, all unencrypted activities can be intercepted. If the router itself has malicious code, any unencrypted traffic can be sent to a third party. Those are just the basics, but trying to put band-aid solutions on a fundamentally broken system is a losing battle.
GrapheneOS distrusts networks as much as possible, so I do too. Even if I own the network, I am not a network engineer, so the chances of fault are high. In the simplest case, the network is a gateway to all activity that happens on the LAN, and it only takes one zero day to make that happen. The best mitigation is proper encryption and no self-signed certificates (where possible).