If your actual media files live on a home NAS or computer but you want reliable, secure remote access, routing through a VPS avoids exposing your home network directly to the internet. This guide covers the pattern.
The Core Problem This Solves
Exposing your home network's ports directly to the internet (port forwarding) carries real security risk and often requires dealing with dynamic IP addresses and router configuration — a VPS-based approach avoids both issues.
Architecture Option 1: VPS as a Reverse Proxy to Home Server
Internet → VPS (public IP, reverse proxy) → VPN tunnel → Home media server (private)Step 1 — Set Up a VPN Tunnel Between Your VPS and Home Network
See How to Set Up a VPN Server with WireGuard — run the WireGuard server on your VPS, with your home server/NAS as a client connecting to it, establishing a private tunnel between the two.
Step 2 — Verify Connectivity Through the Tunnel
ping 10.8.0.2Confirm your VPS can reach your home server's tunnel IP before proceeding.
Step 3 — Configure Nginx on the VPS as a Reverse Proxy
server {
listen 443 ssl;
server_name media.yourdomain.com;
location / {
proxy_pass http://10.8.0.2:8096;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}Traffic reaches your VPS's public IP, then routes privately through the VPN tunnel to your home server — your home network's actual IP is never directly exposed.
Step 4 — Add SSL
sudo certbot --nginx -d media.yourdomain.comArchitecture Option 2: Host the Media Server Directly on the VPS
If your media library can reasonably live on the VPS itself (rather than staying on home hardware), simply run Jellyfin/Plex directly on the VPS — see How to Install Jellyfin Media Server on a VPS, entirely avoiding the home-network complexity.
Choosing Between the Two Approaches
| Factor | VPS as Proxy to Home Server | Media Server Directly on VPS |
|---|---|---|
| Storage location | Stays on your existing home hardware | Needs VPS storage (or attached network storage) |
| Setup complexity | More complex (VPN tunnel, reverse proxy) | Simpler, single-server setup |
| Home network exposure | None — fully tunneled | N/A, no home component at all |
Testing Remote Access
Test from a network outside your home (mobile data, a friend's network) to confirm remote access genuinely works end-to-end, not just from within your home network where local access might work regardless of the remote configuration.
Common Errors
502 Bad Gateway from the VPS — verify the VPN tunnel is actually up and the home server is reachable at its tunnel IP; test with a direct curl from the VPS first.
Works remotely but very slow — your home network's upload bandwidth becomes the bottleneck in this architecture, since content ultimately still transfers from home through the tunnel; verify your home connection's upload speed is adequate for your streaming needs.
Continue Reading
- How to Set Up a VPN Server with WireGuard
- How to Install Jellyfin Media Server on a VPS
- How to Secure a Media Server (Preventing Unauthorized Access to Your Library)
Browse more articles in Media & Streaming Servers.
