Kennisbank

If your actual media files live on a home NAS or computer but you want reliable, secure remote access, routing through a VPS avoids exposing your home network directly to the internet. This guide covers the pattern.

The Core Problem This Solves

Exposing your home network's ports directly to the internet (port forwarding) carries real security risk and often requires dealing with dynamic IP addresses and router configuration — a VPS-based approach avoids both issues.

Architecture Option 1: VPS as a Reverse Proxy to Home Server

Internet → VPS (public IP, reverse proxy) → VPN tunnel → Home media server (private)

Step 1 — Set Up a VPN Tunnel Between Your VPS and Home Network

See How to Set Up a VPN Server with WireGuard — run the WireGuard server on your VPS, with your home server/NAS as a client connecting to it, establishing a private tunnel between the two.

Step 2 — Verify Connectivity Through the Tunnel

ping 10.8.0.2

Confirm your VPS can reach your home server's tunnel IP before proceeding.

Step 3 — Configure Nginx on the VPS as a Reverse Proxy

server {
    listen 443 ssl;
    server_name media.yourdomain.com;

    location / {
        proxy_pass http://10.8.0.2:8096;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Traffic reaches your VPS's public IP, then routes privately through the VPN tunnel to your home server — your home network's actual IP is never directly exposed.

Step 4 — Add SSL

sudo certbot --nginx -d media.yourdomain.com

Architecture Option 2: Host the Media Server Directly on the VPS

If your media library can reasonably live on the VPS itself (rather than staying on home hardware), simply run Jellyfin/Plex directly on the VPS — see How to Install Jellyfin Media Server on a VPS, entirely avoiding the home-network complexity.

Choosing Between the Two Approaches

Testing Remote Access

Test from a network outside your home (mobile data, a friend's network) to confirm remote access genuinely works end-to-end, not just from within your home network where local access might work regardless of the remote configuration.

Common Errors

502 Bad Gateway from the VPS — verify the VPN tunnel is actually up and the home server is reachable at its tunnel IP; test with a direct curl from the VPS first.

Works remotely but very slow — your home network's upload bandwidth becomes the bottleneck in this architecture, since content ultimately still transfers from home through the tunnel; verify your home connection's upload speed is adequate for your streaming needs.

Continue Reading

• How to Set Up a VPN Server with WireGuard
• How to Install Jellyfin Media Server on a VPS
• How to Secure a Media Server (Preventing Unauthorized Access to Your Library)

Browse more articles in Media & Streaming Servers.