Editing Troubleshooting:Plex Troubleshooting

This guide covers remote access to Plex Media Server on the Synology NAS (<code>StrawberryNAS</code>, VPN IP <code>10.8.0.2</code>) via the Caddy reverse proxy at <code>https://plex.jb-vpn.uk</code>.

== Architecture ==

<pre>
Internet → plex.jb-vpn.uk:443 (HTTPS, Caddy on VPS)
         → 10.8.0.2:32400 (HTTP, Plex on Synology via OpenVPN)
</pre>

Plex is '''not''' exposed on port 32400 to the public internet. Remote access uses the reverse proxy on port 443, not Plex's built-in Remote Access port forwarding.

== Synology Plex settings ==

In '''Plex → Settings → Network''' (show Advanced):

{| class="wikitable"
|-
| Setting || Value
|-
| '''Custom server access URLs''' || <code>https://plex.jb-vpn.uk:443</code> only
|-
| '''LAN Networks''' || <code>192.168.1.0/255.255.255.0,10.8.0.0/255.255.255.0</code>
|-
| '''Treat WAN IP As LAN Bandwidth''' || Enabled
|-
| '''Secure connections''' || Preferred
|-
| '''List of IP addresses allowed without auth''' || Empty
|}

=== Custom server access URLs — important ===

* Use '''only''' the public HTTPS URL with explicit port <code>:443</code>.

* Do '''not''' add VPN or LAN URLs such as <code>http://10.8.0.2:32400</code> or <code>http://strawberrynas:32400</code>. Plex publishes these to <code>plex.tv</code> and remote clients will try unreachable addresses.

* After changing this setting, restart Plex on the Synology and wait 2–5 minutes for <code>plex.tv</code> to refresh.

=== Remote Access page shows "not available" ===

This is '''expected'''. Plex reports the home LAN IP (<code>192.168.1.21</code>) and home public IP, but port 32400 is not forwarded on the home router or VPS. Remote access works through <code>https://plex.jb-vpn.uk</code> instead.

== How to access Plex remotely ==

* '''Web''': <code>https://plex.jb-vpn.uk/web</code> or <code>https://app.plex.tv</code>

* '''Apps''': Sign in to your Plex account; the server should appear once custom access URLs are correct

At home, local access via <code>http://strawberrynas:32400</code> or <code>http://192.168.1.21:32400</code> is fine. When testing remote access, use the public URL above — not the local hostname.

== Caddy configuration ==

Canonical config: <code>/etc/caddy/Caddyfile</code> (also in <code>app.jb/docs/caddy/Caddyfile</code>).

<pre class="lang-caddy">
plex.jb-vpn.uk {
    reverse_proxy http://10.8.0.2:32400 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-Port {server_port}
        header_up Upgrade {http.request.header.Upgrade}
        header_up Connection {http.request.header.Connection}
        header_down Location http://10.8.0.2:32400 https://plex.jb-vpn.uk
        header_down Location https://10.8.0.2:32400 https://plex.jb-vpn.uk
        header_down Location http://192.168.1.21:32400 https://plex.jb-vpn.uk
        header_down Location https://192.168.1.21:32400 https://plex.jb-vpn.uk
        header_down Location http://strawberrynas:32400 https://plex.jb-vpn.uk
        header_down Location https://strawberrynas:32400 https://plex.jb-vpn.uk
    }
}
</pre>

=== Do not use <code>header_up X-Plex-''</code> ===

'''Never''' add lines like:

<pre class="lang-caddy">
header_up X-Plex-Token {http.request.header.X-Plex-Token}
</pre>

Plex clients send the auth token in the '''query string''' (<code>?X-Plex-Token=...</code>). If the header is missing, Caddy still sends an empty <code>X-Plex-Token</code> header upstream. Plex prefers the header over the query parameter and returns '''401 Unauthorized''' / '''Not Authorised''' for library requests.

Caddy forwards client headers by default; no explicit <code>X-Plex-''</code> <code>header_up</code> lines are needed.

After editing the Caddyfile:

<pre class="lang-bash">
caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy
</pre>

== Common issues ==

=== "Not Authorised" when opening libraries (web) ===

'''Cause''': Usually the empty <code>X-Plex-Token</code> header bug above, or custom access URLs pointing at unreachable VPN/LAN addresses.

'''Fix''':
# Remove <code>header_up X-Plex-*</code> from the Caddy Plex block and reload Caddy.
# Set custom server access URLs to <code>https://plex.jb-vpn.uk:443</code> only on the Synology.
# Hard-refresh the browser or use a private window at <code>https://plex.jb-vpn.uk/web</code>.

=== Plex app shows server as "unreachable" ===

'''Cause''': Stale connection list from <code>plex.tv</code>, or bad custom access URLs.

'''Fix''':
# Confirm custom access URL is correct (see above).
# Force-quit and reopen the Plex app.
# Verify the proxy works: <code>curl -s https://plex.jb-vpn.uk/identity</code> should return XML with <code>claimed="1"</code>.

=== 502 Bad Gateway from <code>plex.jb-vpn.uk</code> ===

'''Cause''': VPN tunnel down, Plex not running, or Plex restarting.

'''Fix''':

<pre class="lang-bash">
# On VPS
ping -c 2 10.8.0.2
nc -zv 10.8.0.2 32400
cat /var/log/openvpn-status.log
journalctl -u caddy -n 20 | grep -i plex
</pre>

=== Web UI loads but API calls fail (cross-origin) ===

'''Symptom''': Browser referer shows <code>http://strawberrynas:32400</code> but API calls go to <code>plex.jb-vpn.uk</code>.

'''Cause''': Opening Plex locally while custom URLs point at the public proxy.

'''Fix''': For remote testing, use <code>https://plex.jb-vpn.uk/web</code> only. Remove local URLs from custom server access URLs.

== Verification ==

<pre class="lang-bash">
# Plex identity (no auth required)
curl -s https://plex.jb-vpn.uk/identity

# VPN reachability
ping -c 2 10.8.0.2
curl -sI http://10.8.0.2:32400/web

# Caddy logs
journalctl -u caddy -n 50 | grep -iE 'plex|10\.8\.0\.2'
</pre>

With a valid token, library access through the proxy should return XML (not 401):

<pre class="lang-bash">
curl -s "https://plex.jb-vpn.uk/library/sections?X-Plex-Token=YOUR_TOKEN" | head
</pre>

== Related documentation ==

* [[Services:Current Services|Services:Current Services]] — Plex service inventory

* [[Troubleshooting:Service Troubleshooting|Troubleshooting:Service Troubleshooting]] — general reverse proxy issues

* [[Documentation:Integration|OpenVPN:Integration]] — VPN + Caddy integration


[[Category:Documentation]]
[[Category:Documentation/Troubleshooting]]