Troubleshooting:Plex Troubleshooting

This guide covers remote access to Plex Media Server on the Synology NAS (StrawberryNAS, VPN IP 10.8.0.2) via the Caddy reverse proxy at https://plex.jb-vpn.uk.

Architecture

Internet → plex.jb-vpn.uk:443 (HTTPS, Caddy on VPS)
         → 10.8.0.2:32400 (HTTP, Plex on Synology via OpenVPN)

Plex is not exposed on port 32400 to the public internet. Remote access uses the reverse proxy on port 443, not Plex's built-in Remote Access port forwarding.

Synology Plex settings

In Plex → Settings → Network (show Advanced):

Setting	Value
Custom server access URLs	https://plex.jb-vpn.uk:443 only
LAN Networks	192.168.1.0/255.255.255.0,10.8.0.0/255.255.255.0
Treat WAN IP As LAN Bandwidth	Enabled
Secure connections	Preferred
List of IP addresses allowed without auth	Empty

Custom server access URLs — important

• Use only the public HTTPS URL with explicit port :443.

• Do not add VPN or LAN URLs such as http://10.8.0.2:32400 or http://strawberrynas:32400. Plex publishes these to plex.tv and remote clients will try unreachable addresses.

• After changing this setting, restart Plex on the Synology and wait 2–5 minutes for plex.tv to refresh.

Remote Access page shows "not available"

This is expected. Plex reports the home LAN IP (192.168.1.21) and home public IP, but port 32400 is not forwarded on the home router or VPS. Remote access works through https://plex.jb-vpn.uk instead.

How to access Plex remotely

• Web: https://plex.jb-vpn.uk/web or https://app.plex.tv

• Apps: Sign in to your Plex account; the server should appear once custom access URLs are correct

At home, local access via http://strawberrynas:32400 or http://192.168.1.21:32400 is fine. When testing remote access, use the public URL above — not the local hostname.

Caddy configuration

Canonical config: /etc/caddy/Caddyfile (also in app.jb/docs/caddy/Caddyfile).

plex.jb-vpn.uk {
    reverse_proxy http://10.8.0.2:32400 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-Port {server_port}
        header_up Upgrade {http.request.header.Upgrade}
        header_up Connection {http.request.header.Connection}
        header_down Location http://10.8.0.2:32400 https://plex.jb-vpn.uk
        header_down Location https://10.8.0.2:32400 https://plex.jb-vpn.uk
        header_down Location http://192.168.1.21:32400 https://plex.jb-vpn.uk
        header_down Location https://192.168.1.21:32400 https://plex.jb-vpn.uk
        header_down Location http://strawberrynas:32400 https://plex.jb-vpn.uk
        header_down Location https://strawberrynas:32400 https://plex.jb-vpn.uk
    }
}

Do not use header_up X-Plex-

Never add lines like:

header_up X-Plex-Token {http.request.header.X-Plex-Token}

Plex clients send the auth token in the query string (?X-Plex-Token=...). If the header is missing, Caddy still sends an empty X-Plex-Token header upstream. Plex prefers the header over the query parameter and returns 401 Unauthorized / Not Authorised for library requests.

Caddy forwards client headers by default; no explicit X-Plex- header_up lines are needed.

After editing the Caddyfile:

caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy

Common issues

"Not Authorised" when opening libraries (web)

Cause: Usually the empty X-Plex-Token header bug above, or custom access URLs pointing at unreachable VPN/LAN addresses.

Fix:

1. Remove header_up X-Plex-* from the Caddy Plex block and reload Caddy.
2. Set custom server access URLs to https://plex.jb-vpn.uk:443 only on the Synology.
3. Hard-refresh the browser or use a private window at https://plex.jb-vpn.uk/web.

Plex app shows server as "unreachable"

Cause: Stale connection list from plex.tv, or bad custom access URLs.

Fix:

1. Confirm custom access URL is correct (see above).
2. Force-quit and reopen the Plex app.
3. Verify the proxy works: curl -s https://plex.jb-vpn.uk/identity should return XML with claimed="1".

502 Bad Gateway from plex.jb-vpn.uk

Cause: VPN tunnel down, Plex not running, or Plex restarting.

Fix:

# On VPS
ping -c 2 10.8.0.2
nc -zv 10.8.0.2 32400
cat /var/log/openvpn-status.log
journalctl -u caddy -n 20 | grep -i plex

Web UI loads but API calls fail (cross-origin)

Symptom: Browser referer shows http://strawberrynas:32400 but API calls go to plex.jb-vpn.uk.

Cause: Opening Plex locally while custom URLs point at the public proxy.

Fix: For remote testing, use https://plex.jb-vpn.uk/web only. Remove local URLs from custom server access URLs.

Verification

# Plex identity (no auth required)
curl -s https://plex.jb-vpn.uk/identity

# VPN reachability
ping -c 2 10.8.0.2
curl -sI http://10.8.0.2:32400/web

# Caddy logs
journalctl -u caddy -n 50 | grep -iE 'plex|10\.8\.0\.2'

With a valid token, library access through the proxy should return XML (not 401):

curl -s "https://plex.jb-vpn.uk/library/sections?X-Plex-Token=YOUR_TOKEN" | head

Related documentation

• Services:Current Services — Plex service inventory

• Troubleshooting:Service Troubleshooting — general reverse proxy issues

• OpenVPN:Integration — VPN + Caddy integration