Security is shared: our relays stop a lot before it reaches your server, and the rest is in your Jellyfin settings.
What the relays do
- Your home stays closed. Nothing at home accepts connections from the internet. The relay passes on only Jellyfin traffic for your address, through the tunnel your plugin opened.
- Encryption. Viewers connect over HTTPS, and the tunnel between the relay and your plugin is encrypted too.
- Known attackers blocked. Relays drop traffic from addresses on the CrowdSec community blocklist, before it reaches your server.
- Anti-DDoS. Relays sit behind our hosting provider's network-level DDoS protection.
- Password guessing slowed down. After 10 failed sign-ins from one address within 15 minutes, that address is paused for 15 minutes on your server, and no address can try more than 30 sign-ins a minute.
- Setup wizard out of reach. Jellyfin's first-time setup pages only work from your home network, never through the relay.
- Security update reminders. We tell you when your Jellyfin version has a known security problem. See Security checklist.
What stays with you
- Jellyfin users and passwords, and what each user can access.
- Keeping Jellyfin, its plugins and the computer it runs on up to date.
- Who you share the address with.
The security checklist covers all of it.
Optional: your own protection at home
Because the plugin passes each viewer's real address to Jellyfin, tools on your own server see real addresses too:
- CrowdSec with its Jellyfin collection, or fail2ban with a Jellyfin filter, can read Jellyfin's log and block addresses that fail to sign in repeatedly.
- Jellyfin's own remote IP address filter (Dashboard → Networking) can allow or block countries' networks or specific addresses.
A block at home works through Jellyfin: the viewer's connection still reaches the relay, and Jellyfin refuses it. That's normal.