Selfhosted

This is probably not what you're looking for, but I found registering a cheap domain name and using a dynamic DNS script that checks every hour or so against your public IP to be a good way to mitigate issues. It also depends on your ISP. Mine typically only renews upon a reboot of the modem or a new PPPoE authentication.

Others have also suggested Tailscale, and I think that's also a worthwhile option. It's a pretty easy thing to set and forget, working like any oher VPN client. This is the least complex option to navigate, and if Plex was the only service you were forwarding then it's likely the best option.

Tailscale is the simplest way I've found, this does become a bit finicky when it comes to friends and family but you can share a single device aka your Jellyfin server with them. This saves exposing ports etc.

One option that i am not sering here that is also very safe is install wireguard and allow them to use it via vpn.

If your ISP blocks port forwarding, this guide can help.

If you have direct access to your server from the outside, then you are concerned about these changes. Am I mistaken?

Not sure if my setup is unique or wrong but here's what I use:

1. I registered a domain with Name cheap and created subdomains for the tools I wanted to access (i.e. jellyfin.domain.tld, sonarr.domain.tld)
2. A DDNS client on my OpenWRT router updates the IP address for those subdomains. Traffic for each subdomain is pointed at my server.
3. Nginx Reverse Proxy runs on my server. This provides HTTPS certificates and is pretty straightforward.

I also use Tailscale for remote access and I'm not sure that my friends and family are ready for that. (Admittedly, I'm still on Plex.) Registering your own domain and using a DDNS service and reverse proxy will give your users an easier experience than Tailscale. I can give an easy-to-remember URL to folks rather than a new VPN platform to learn.

If security is more important, Tailscale is the best option for remote connections.

Why don't we need this for Plex? Because Plex has all of the above steps baked into its service.

I started to follow a guide (& doing a bunch of googling + chatGPT) for setting Jellyfin remote access for my parents. And this is where I’m a bit out of my depth [...] I have a dynamic IP [...] duckDNS path

Stay away from DuckDNS. Used to be fabulous but now it's incredibly overused and very unstable. Works, then just stops for a period of time. Check out HurricaneElectric. Any A record can be enabled as DDNS that you can update with just curl. It's great. I've been using them for about 10 years now without issues. They were down one time like... 5 years ago for several hours, and that was it.

Also as a side note: I see people talk about Caddy as a reverse proxy for extra security, but what does it do?

This option is nice if you self-host a web server with no bandwidth restriction. You setup caddy, update your DNS to register your home IP on X domain. Point jelly.x.domain to whatever your public IP is, with the port as a reverse proxy, then your IP is reachable via jelly.x.domain but it's not a great setup for you because of the dynamic IP unless you do a bunch of setup to ensure it routes.

IMO the best option would be;

1. Install jellyfin server
2. Open port 8096 on your router for your jellyfin server IP
3. Create a jellyfin user for your parents, and enable remote connection
4. Setup DDNS (I highly suggest he.net) and point your domain to your IP
5. Setup cron job to update your DDNS record with he.net every hour or so using curl
6. Setup jellyfin for your parents TV or whatever device they'll use to watch it
7. Login and enjoy

Great thread, thanks everyone

Lots of dynamic DNS providers allow you to register a aubdomain and update the IP it points to with an API call. You can use something like this tool for it: https://github.com/lopsided98/dnsupdate - just run it on a schedule on the same machine and you're golden.

There are also Docker container based solutions if you'd rather go that route. Once you have a stable entry point, you can decide what to do with it.

I would personally get a Raspberry Pi and run Wireguard and Dnsupdater on it, use port forwarding in the router for Wireguard and close down everything else. Then share the Wireguard connection details with your friends and family. You can even set it up so that Wireguard connections are only granted access to your Jellyfin server, plenty of tutorials out there on how to configure firewall rules on the Wireguard machine.

Jellyfin has a pile of security issues regarding unauthenticated enumeration of the media that’s shared. That’s probably not awesome on the public internet. 

I’d suggest setting up Tailscale. https://github.com/jellyfin/jellyfin/issues/5415