I am making this post in good faith
In my last post I asked about securely hosting Jellyfin given my specific setup. A lot of people misunderstood my situation, which caused the whole thread to turn into a mess, and I didn’t get the help I needed.
I am very new to selfhosting, which means I don’t know everything. Instead of telling me that I don’t know something, please help me learn and understand. I am here asking for help, even if I am not very good at it, which I apologize for.
With that said, let me reoutline my situation:
I use my ISP’s default router, and the router is owned by Amazon. I am not the one managing the router, so I have no control over it. That alone means I have significant reason not to trust my own home network, and it means I employ the use of ProtonVPN to hide my traffic from my ISP and I require the use of encryption even over the LAN for privacy reasons. That is my threat model, so please respect that, even if you don’t agree with it. If you don’t agree with it, and don’t have any help to give, please bring your knowledge elsewhere, as your assistance is not required here. Thank you for being respectful!
Due to financial reasons, I can only use the free tier of ProtonVPN, and I want to avoid costs where I can. That means I can only host on the hardware I have, which is a Raspberry Pi 5, and I want to avoid the cost of buying a domain or using a third party provider.
I want to access Jellyfin from multiple devices, such as my phone, laptop, and computer, which means I’m not going to host Jellyfin on-device. I have to host it on a server, which is, in this case, the Raspberry Pi.
With that, I already have a plan for protecting the server itself, which I outlined in the other post, by installing securecore on it. Securing the server is a different project, and not what I am asking for help for here.
I want help encrypting the Jellyfin traffic in transit. Since I always have ProtonVPN enabled, and Android devices only have one VPN slot enabled, I cannot use something such as Tailscale for encryption. There is some hope in doing some manual ProtonVPN configurations, but I don’t know how that would work, so someone may be able to help with that.
All Jellyfin clients I have used (on Linux and Android) do not accept self-signed certificates. You can test this yourself by configuring Jellyfin to only accept HTTPS requests, using a self-signed certificate (without a domain), and trying to access Jellyfin from a client. This is a known limitation. I wouldn’t want to use self-signed certificates anyways, since an unknown intruder on the network could perform a MITM attack to decrypt traffic (or the router itself, however unlikely).
Even if I don’t trust my network, I can still verify the security and authenticity of the software I use in many, many ways. This is not the topic of this post, but I am mentioning it just in case.
Finally, I want to mention that ProtonVPN in its free tier does not allow LAN connections. The only other VPN providers I would consider are Mullvad VPN or IVPN, both of which are paid. I don’t intend to get rid of ProtonVPN, and again that is not the topic of this post.
Please keep things on-topic, and be respectful. Again, I am here to learn, which is why I am asking for help. I don’t know everything, so please keep that in mind. What are my options for encrypting Jellyfin traffic in transit, while prioritizing privacy and security?
You must log in or register to comment.
How about creating your own LAN within the untrusted network?
Something like an inexpensive OpenWRT router would do fine. Connect all your devices and the server to the router. They are now on a trusted network. Set up Wireguard on the OpenWRT router to connect to Proton so that your outbound traffic from all your devices is secured.
I was looking for this. Op seems to be obsessed with “zero trust”, so creating a trusted area for this stuff would be an easy win.
Exactly! I did that for a couple years until I found a cheap modem to replace the ISP modem. It didn’t do any routing, so there was no weird NAT issue, it just converted the DSL signal to Ethernet with a WAN IP.
I didn’t have to change any network settings on my LAN when I switched, or when I moved to another place with a different ISP. I had that same router for years, even after I got a dedicated AP for my house.
I read the old thread and now this one.
As I understand it, you want to create connection between clients on your lan, but you don’t trust your lan, so it’s like having a raspberry pi server and some client both on the coffee shop network and you want them to communicate securely?
Tailscale is what you want. Easy setup, free, and allows exactly this to happen.
I use tailscale for exactly this purpose. And with the added benefit of bring able to watch media and manage the device remotely and easily
ProtonVPN in its free tier does not allow LAN connections
This is the limiting factor. In order to get around this, you’ll have to put your Jellyfin server on the Internet. Hopefully you can enable port forwarding. If not, you have painted yourself into a corner.
If you cannot use self-signed or internal CA certs, you will also need a domain name, and something like Let’s Encrypt to issue certs for that domain.
Although not ideal, I would be willing to pay for ProtonVPN (or another) if that’s what is required. If I did have LAN connections, what are my options? Eventually I will get a more trustworthy router, but I still don’t want to trust it by sending data in plaintext, even if I can control it and enable port forwarding.
Already answered in your previous post: https://lemm.ee/post/60855169/19569046
I previously proffered some information in the first thread.
But there’s something I wish to clarify about self-signed certificates, for the benefit of everyone. Irrespective of whichever certificate store that an app uses – either its own or the one maintained by the OS – the CA Browser Forum, which maintains the standards for public certificates, prohibits issuance of TLS certificates for reserved IPv4 or IPv6 addresses. See Section 4.2.2.
This is because those addresses will resolve to different machines on different networks. Whereas a certificate for a global-scope IP address is fine because it should resolve to the same destination. If certificate authorities won’t issue certs for private IP addresses, there’s a good chance that apps won’t tolerate such certs either. Nor should they, for precisely the reason given above.
A proper self-signed cert – either for a domain name or a global-scope IP address – does not create any MITM issues as long as the certificate was manually confirmed the first time and added to the trust store, either in-app or in the OS. Thereafter, only a bona fide MITM attack would raise an alarm, the same as if a MITM attacker tries to impersonate any other domain name. SSH is the most similar, where trust-on-first-connection is the norm, not the outlier.
There are safe ways to use self-signed certificate. People should not discard that option so wontonly.
It sounds like the clients do not have the ability to manually trust a self-signed cert.
I don’t get that…
I have self-signed SSL certificate and intermediateCA installed on all my devices and works flawlessly with every application that accept those (on android the manifest.XML has to allow user based certificate which is in most cases).
One exception on Android was the use of MPV which doesn’t do that and never will? However, the web player video type from official application works without issues…
I have navidrome, jellyfin, Ironfox, LibreTube, KoReader, Findroid… All work flawlessly with self-signed certs !
The issue here (as said in the second answer of his linked jellyfin post) is that them needs a reverse proxy that takes care of the SSL handshake and not jellyfin directly. So OP was missing a lot of good information in them’s first post…
If it’s signed by an intermediate CA, then it’s not self-signed.
Huh? Yeah it is… It’s a self-signed intermediate CA, signed by a self-signed rootCA.
In my case a miniCA in my lan.
Right. If it’s signed by a CA, it’s not self signed. Self signed means signed by nobody but the server that generated it.
self-signed certificates are public key certificates that are not issued by a certificate authority (CA)
https://en.wikipedia.org/wiki/Self-signed_certificate
An internal CA whose signing certs you’ve manually installed is still a trusted CA.
Ohhhhh ! Sometimes I just need to sh*up !
Thanks for the clarification.
deleted by creator
Thank you for this!
Is OPNsense like dd-wrt or OpenWrt?
The thing is (and this is by no means a knock on you) if you are doing pen testing then you definitely need to increase your knowledge on networking.
I have background in Wi-Fi hacking and LAN attacks, and I understand the structure of networking (LAN, WAN, layers of the internet, DNS, CAs, etc.). My head starts to hurt when RADIUS is involved, ad hoc networking (which I understand the concepts of, just not how it works. I want to learn this first), mDNS, and other complicated topics. I’m trying to push past those mental roadblocks and learn as best I can, but it’s a tricky topic!
There’s something to check out just to get some concepts. You can do plenty of things to harden your security that could give you the comfort you need without defaulting to encrypted connections over LAN.
Thank you! I’ll definitely check this out. You’ve been a huge help!
deleted by creator
Here’s an idea: on your android device use something like Insular to create a work profile, that way you get its own VPN slot, add your selfhosted-related apps there along with Tailscale. You can keep ProtonVPN on for your other apps, while using TS for your “LAN away from home” stuff. Since Tailscale already encrypts all traffic, you don’t have to worry about HTTPS, certs, et al.
THIS
While I would make the modification to use Android’s Private Space instead of a work profile (or Shelter instead of Insular), this was such an obvious solution, and I feel stupid for not seeing it. I might use Wireguard instead of Tailscale, I don’t know yet, but thank you! Consider yourself an outside the box thinker!
We all got hung up on trying to fix Proton, when Android was the issue here!
One thing that I haven’t seen anyone mention yet, in this post or the last one, how to you plan on aquiring videos for your server? If you plan on torrenting, you just have to pay for a vpn, Proton doesn’t allow you to make p2p connections like that on a free account
I’ve been able to use Proton for torrenting, although at abysmal speeds. I don’t acquire many new videos, so this isn’t an issue quite yet. When I have more money I will absolutely be switching to Mullvad VPN.
Don’t use Mullvad for torrenting. They’re a great VPN but they had to remove port forwarding so you’ll be unable to torrent properly. AirVPN is an alternative that still has port forwarding available.
Be careful, Mullvad doesnt allow port forwarding. I understand this to be important for torrent purposes.
Correct, trackers will work but DHT or whatever it’s called won’t, end up with a lot of dead torrents trying to run it through mull, but I paid a bit in advance so I can’t swap yet.
Nzbs work most of the time anyway
and Android devices only have one VPN slot enabled, I cannot use something such as Tailscale for encryption.
I solved a similar situation with a tailscale subnet router . a tailscale subnet router is a tailscale node that exposes the non-tailscale network to the tailscale network. This way I am able to access one of my routers (and its PBX) from all tailscale nodes. The android phone has only tailscale as a VPN. If i pay for mulvad I can have the rest of the traffic go over a mullvad node.
doesn’t really help you here though, unless you install protonVPN on the pi and add that as a tailscale exit node.
Again, Tailscale.
Since I always have ProtonVPN enabled, and Android devices only have one VPN slot enabled, I cannot use something such as Tailscale for encryption.
Tailscale is only for the server/host. You’re not changing all of your VPN services over to this, you’re using it in a ‘reverse’ fashion. You’re VPN-ing the server out to the world so it’s reachable and you have port forwarding options, etc.
From there, it can be reached by any client on the internet as a service. From there though, I don’t know how you’d get to it securely without a domain and SSL (Let’s Encrypt/Caddy) certs.
A domain is only like $16/year. So it’s not prohibitively expensive.
Domains can be even cheaper than that, I got a .net address from porkbun for $12.50 a year. That’s cheap enough for even me, and I am broke, y’all.
It’s can’t be reached by any client, only clients on machines logged into your tail scale network.
I remember you were worried about your ISP messing things up for you, hence the VPN. I would recommend creating a “Virtual Machine” that does all of your downloading to whatever hard drive you’re using. That VM can have proton installed. Then, on your regular computer (not within the VM), you can host Jellyfin with no VPN involved, making it accessible at 192.168.0.xx.
I think this hits your goals without needing to expose Jellyfin to the Internet. Plus it has minimal technical complexity. Your downloading traffic will be VPN protected, but Jellyfin will still be accessible to your local network.
edit: You can set up a password for Jellyfin, protecting it from your internal threats.edit2: You can use letsencrypt to create a certificate that picky clients will accept. Buy a domain, any domain, and configure the “A record” to point to 192.168.0.xx (your Jellyfin IP). Then tell your client to go to whatever domain you get, like “luigiliterallydidnothingwrongplzfree.com”, then the client will have to use the internet to ask DNS what the IP address is, but after that, it will just use your local network.
edit3: Since you just have the raspberry PI, instead of using a Virtual Machine, you could have 2 separate SD cards. One only has the downloader and VPN installed, the other only has Jellyfin installed (no VPN). Then swap as needed.
Wow, there isn’t a single solution in here with the obvious answer?
You’ll need a domain name. It doesn’t need to be paid - you can use DuckDNS. Note that whoever hosts your DNS needs to support dynamic DNS. I use Cloudflare for this for free (not their other services) even though I bought my domains from Namecheap.
Then, you can either set up Let’s Encrypt on device and have it generate certs in a location Jellyfin knows about (not sure what this entails exactly, as I don’t use this approach) or you can do what I do:
- Set up a reverse proxy - I use Traefik but there are a few other solid options - and configure it to use Let’s Encrypt and your domain name.
- Your reverse proxy should have ports 443 and 80 exposed, but should upgrade http requests to https.
- Add Jellyfin as a service and route in your reverse proxy’s config.
On your router, forward port 443 to the outbound secure port from your PI (which for simplicity’s sake should also be port 443). You likely also need to forward port 80 in order to verify Let’s Encrypt.
If you want to use Jellyfin while on your network and your router doesn’t support NAT loopback requests, then you can use the server’s IP address and expose Jellyfin’s HTTP ports (e.g., 8080) - just make sure to not forward those ports from the router. You’ll have local unencrypted transfers if you do this, though.
Make sure you have secure passwords in Jellyfin. Note that you are vulnerable to a Jellyfin or Traefik vulnerability if one is found, so make sure to keep your software updated.
If you use Docker, I can share some config info with you on how to set this all up with Traefik, Jellyfin, and a dynamic dns services all up with docker-compose services.
OP, I have been facing the same situation as you in this community recently. This was not the case when I first joined Lemmy but the behaviour around these parts has started to resemble Reddit more and more. But we’ll leave it at that.
I think I have a solution for you if you’re willing to spend $2-$3 a month - set up a VPS and run a Wireguard server on it. Run clients on your devices and the raspberry pi and connect to it.
As for your LAN: from the discussion you linked, it seems that Jellyfin will use the CAs present in the OS trust store. That’s not very hard to do on Linux but I guess if you have to do it on Android you’d have some more trouble. In either case, using a reverse-proxy (I like HAProxy but I use it at work and it might be more enterprise than you need, for beginners Caddy is usually easier) will fix the trouble you’re having with your own CA and self-signed certs.
I am interested in the attack vector you mentioned; could you elaborate on the MITM attack?
Unfortunately, if you don’t have control over your network, you cannot force a DNS server for your devices unless you can set it yourself for every individual client. If I assume that you can do that, then:
- Set up DNS server on Pi
- Set up CA on Pi
- Create root CRT, CSR and server certs from it (bare-minimim setup)
- Copy over this stuff to Jellyfin image/VM, and copy root cert to clients trust store.
- Run reverse proxy in front of Jellyfin and configure the correct IP address of the reverse proxy with an A record in your DNS server.
- Configure reverse-proxy with server/application cert.
- Use RethinkDNS on Android to pass everything through the wireguard server hosted on the VPS, and set private DNS to the DNS server hosted on the Pi.
I think that should do it. This turned out more complicated than I imagined (it’s more of a brain dump at this point), feel free to ask if it is overwhelming.
OP, I have been facing the same situation as you in this community recently. This was not the case when I first joined Lemmy but the behaviour around these parts has started to resemble Reddit more and more. But we’ll leave it at that.
I’ve noticed that behavior is split between communities. Lemmy gets a bit weird because communities are usually hyper-specialized, and sometimes instances themselves cultivate different cultures (e.g. lemmy.ml is usually for privacy enthusiasts, since that’s where c/privacy is hosted). That, with the addition of specific idols for each community (e.g. Louis Rossmann for the selfhosted community) affects how each community behaves. That’s my theory, anyways.
I am interested in the attack vector you mentioned; could you elaborate on the MITM attack?
Basically the “this website is not secure” popup you see in your browser is sometimes due to the website using a self-signed cert. There’s no way to verify that that cert is from the website itself or from an attacker trying to inject their own cert, since there’s no CA attached to the cert. If an attacker injects their own self-signed cert, they can use that to decrypt your HTTPS traffic (since your browser will be encrypting using their cert) and then forward your traffic along to the real website so that from your perspective (minus the warning screen) nothing is wrong. I’m oversimplifying this, but that’s basically how it works.
Unfortunately, if you don’t have control over your network, you cannot force a DNS server for your devices unless you can set it yourself for every individual client.
I forgot to mention in this post, but because of browser fingerprinting reasons I don’t want to use a custom DNS. Thanks for the suggestion though!
Edit: Okay, I saw your other post, ignore this answer. It won’t work.
Just to give you another way of doing it, I propose using “a third party provider” for your DNS, which you said you didn’t want, but since I think it could still work, I tell you how it would work:
Duckdns is a free provider for DNS and let’s you create standard certificates via let’s encrypt without exposing the rpi.
You can register for free and just input your local IP for the raspberry e.g. at charger8283.duckdns.org
Since the IP is local, no one outside your network can access it, but because the URL is registered globally, you can get a certificate using nginx proxy manager.
This would result in https traffic, that never leaves your local network and is also free.
Maybe self host your own VPN on a VPS and connect the jellyfin server as a client as well as any other devices you want to see that jellyfin server as other clients and configure the VPN server to not override your default routing and to allow clients to see each other? In my head I don’t think that would conflict with your protonVPN connection.
Your traffic would be encrypted between devices so I wouldn’t say https is nessesary and thus no certs needed.
The rubs that occur to me are that I’m not sure you can do this on a free tier VPS which is the only option I see given your financial limitations. And your devices all need to be able to connect to said VPN.
Edit: Slightly less worse English.
deleted by creator
