Port forwarding was supposed to be the easy part of running Jellyfin. Then the ISP started blocking inbound ports 80 and 443 behind a CGNAT gateway, the router’s UPnP mapping silently failed after a firmware update, and the one time forwarding did work, a Shodan scan found the login page within a week. A different model skips all of that: instead of opening a hole in the firewall, a small agent on the server dials out to a relay, and the viewer connects through that relay’s public address instead of the home IP. Nothing on the router changes, no port stays open, and the server’s real address never shows up in a DNS record anyone can scan.
We tested seven of the best apps for Jellyfin remote streaming without port forwarding, from a five-minute mesh VPN install to a self-hosted control plane you run yourself. Every one of them replaces port forwarding outright, rather than hiding the same open port behind another layer.
What to look for in a Jellyfin remote-access tool
Not every option here works the same way, and the differences matter once you are streaming 4K instead of just SSHing in.
- Direct peer-to-peer connections. A tool that relays every stream through a third-party server adds latency and eats someone else’s bandwidth cap. The best ones negotiate a direct path and only fall back to a relay when NAT gets in the way.
- Whether the viewer needs an app installed. Sharing Jellyfin with a parent or a friend goes better with a plain HTTPS link than with a VPN client they have to configure.
- Free tier limits that actually match your household: user count, device count, and whether those caps apply to self-hosting too.
- A self-hosting option, for anyone who does not want a vendor’s cloud service sitting in the connection path at all.
- Access control granular enough to share the Jellyfin server without exposing every other machine on the same network.
- Encryption that does not depend on you managing certificates by hand.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price/mo |
|---|---|---|---|---|
| Tailscale | Best overall, direct P2P streaming | Windows, macOS, Linux | 6 users, unlimited devices | $6/user |
| Cloudflare Tunnel | Free public link, no client for viewers | Windows, macOS, Linux | Free, unlimited | Free |
| NetBird | Open-source, self-hosted or cloud | Windows, macOS, Linux | 5 users/100 devices (cloud); unlimited self-hosted | $6/user |
| Twingate | Zero-trust access with per-resource policy | Windows, macOS, Linux | 5 users | $5/user |
| Headscale | Fully self-hosted Tailscale control plane | Windows, macOS, Linux | Free, self-hosted only | Free |
| ZeroTier | Simple layer-2 mesh, long track record | Windows, macOS, Linux | 10 devices, 1 network | $18/mo |
| Pangolin | Identity-aware tunnel with a dashboard | Windows, macOS, Linux | 5 users, 5 sites | $4/user |
The apps
1. Tailscale — best overall
Tailscale is a mesh VPN built on WireGuard that puts the Jellyfin server and every viewing device on the same private network, no matter where they physically sit. It tries a direct peer-to-peer path first, so a 4K remux streams at the same speed it would over the LAN, and only drops to a relay when NAT traversal fails. The free Personal plan covers 6 users with unlimited devices per user, which is enough for a household plus a couple of friends. Tailscale Funnel, a built-in feature, can also expose Jellyfin over plain HTTPS for someone who refuses to install a VPN client.
Where it falls short: every regular viewer needs the Tailscale app running, which is one more thing to explain to a parent. A 2026 pricing overhaul also tightened the free tier’s tagged-resource and ACL group limits, which matters more for a small business tailnet than a home one.
Pricing:
- Free: Personal plan, 6 users, unlimited devices, MagicDNS, subnet routing
- Paid: Starter from $6 per user/month
Platforms: Windows, macOS, Linux
Bottom line: the fastest path from “port forwarding is broken” to “streaming works again,” and the one most guides point to first for a reason.
2. Cloudflare Tunnel — best free option
Cloudflare Tunnel runs a small daemon called cloudflared next to Jellyfin that opens an outbound connection to Cloudflare’s edge. Anyone who visits the resulting domain reaches the server without a VPN client, a certificate to manage, or a single inbound port. It is free indefinitely, includes automatic TLS, and sits behind Cloudflare’s DDoS protection by default, which is more than a raw port-forward ever offered.
Where it falls short: sustained high-bitrate 4K streaming through the free tier sits in a gray area of Cloudflare’s terms of service, and per-viewer access control needs a separate Cloudflare Access policy on top of the tunnel itself. It also depends entirely on Cloudflare’s edge staying reachable.
Pricing:
- Free: unlimited tunnels, your own domain, automatic TLS
- Paid: Cloudflare Access policies for finer-grained control, priced separately per user
Platforms: Windows, macOS, Linux
Bottom line: the pick for a link you can text to someone who will never install anything, as long as the streaming volume stays reasonable.
3. NetBird — best value
NetBird is an open-source, WireGuard-based mesh VPN that plays the same role as Tailscale but ships a self-hostable coordination stack. As of version 0.65, the management server, signal server, and relay ship as a single Docker image, so a Jellyfin server and a $5 VPS are enough to run your own private control plane with no per-user fees at all. The managed cloud option exists too, for anyone who would rather skip the setup.
Where it falls short: self-hosting means you are responsible for patching and uptime on the coordination server, and the client UI is noticeably less polished than Tailscale’s. The managed cloud free tier caps out at 5 users and 100 machines.
Pricing:
- Free: unlimited self-hosted (Community Edition); cloud free tier at 5 users/100 machines
- Paid: cloud Team plan from $6 per user/month
Platforms: Windows, macOS, Linux
Bottom line: open source without the trade-offs, for anyone willing to run one more small Docker container.
4. Twingate — best for shared households
Twingate takes a zero-trust approach: instead of putting every device on one flat mesh network, it grants access to individual resources, so a friend gets Jellyfin and nothing else on the home network. Setup involves a connector on the server side and a lightweight client for viewers, with policies managed from a web dashboard rather than a config file.
Where it falls short: the resource-based policy model takes longer to set up than a one-command Tailscale install, and the free Starter plan caps at 5 users, which is tight once a couple of friends are added to a family plan.
Pricing:
- Free: Starter plan, up to 5 users
- Paid: Teams from roughly $5 per user/month
Platforms: Windows, macOS, Linux
Download: Website
Bottom line: the right call when Jellyfin needs to be shared without also handing out access to the NAS and the home router’s admin page.
5. Headscale — best fully self-hosted option
Headscale is an open-source reimplementation of Tailscale’s control server, built by community maintainers (one of whom also works at Tailscale). It speaks the same protocol as the official Tailscale client, so the same app on every device connects to a coordination server you run yourself instead of Tailscale’s cloud, complete with MagicDNS, access control lists, and an embedded DERP relay for NAT traversal.
Where it falls short: it is not an official Tailscale product, so support runs through GitHub issues and community channels rather than a vendor. Running it means standing up and maintaining a coordination server on a small VPS, on top of the Jellyfin box itself.
Pricing:
- Free: fully open source, self-hosted only, no paid tier
Platforms: Windows, macOS, Linux
Bottom line: the pick for anyone who trusts Tailscale’s client software but not a third party holding the keys to the network.
6. ZeroTier — most established mesh option
ZeroTier predates most of this list and emulates a layer-2 network across the internet, which lets legacy or IoT devices on the home network join the same virtual switch as a remote Jellyfin client. It has been running in production deployments for close to a decade, which counts for something when the goal is a connection that keeps working without babysitting.
Where it falls short: a 2026 pricing change cut the free tier from 25 devices and unlimited networks down to 10 devices and a single network, which annoyed a lot of longtime users. The layer-2 emulation also adds slightly more overhead than a pure WireGuard tunnel during a high-bitrate transcode.
Pricing:
- Free: 10 devices, 1 network
- Paid: Essential plan from around $18/month
Platforms: Windows, macOS, Linux
Bottom line: a solid fallback if Tailscale or NetBird’s routing model does not fit, but the shrinking free tier makes it a harder recommendation than it used to be.
7. Pangolin — most unconventional pick
Pangolin is a newer, self-hosted-first tool that pairs a WireGuard tunnel with an identity-aware reverse proxy and a web dashboard, so exposing Jellyfin looks more like configuring a proxy rule than joining a VPN. A lightweight client called Newt connects the home network to a Pangolin server on a VPS, and the dashboard handles TLS certificates, routing, and login policy from there.
Where it falls short: it is younger and smaller than everything else on this list, so the community and the documentation are thinner. Running it still means maintaining a small VPS as the public-facing half of the setup, the same requirement as Headscale.
Pricing:
- Free: Community Edition, self-hosted, free for personal use
- Paid: managed Pangolin Cloud from $4 per user/month, Enterprise self-host from $449/year at scale
Platforms: Windows, macOS, Linux
Bottom line: worth a look for anyone who wants Cloudflare Tunnel’s public-link convenience with none of the third-party dependency.
How to pick the right one
If you want the simplest setup: Tailscale. Install it on the server and one device, and Jellyfin is reachable within minutes.
If you need a link with zero client software for the viewer: Cloudflare Tunnel, as long as the streaming volume stays modest.
If you want the setup fully in your own hands, no third-party coordination server at all: Headscale or a self-hosted NetBird instance.
If Jellyfin needs to go to people outside the household without exposing the rest of the home network: Twingate.
If you tried Tailscale and found the free-tier limits too tight for a small team: NetBird’s self-hosted option removes the caps entirely.
If you want the newest approach and do not mind a smaller community: Pangolin.
FAQ
What is the best free app for Jellyfin remote streaming without port forwarding? Tailscale and Cloudflare Tunnel are both free for personal use. Tailscale is the simpler choice if every viewer is willing to install a client; Cloudflare Tunnel works better for sharing a plain link with someone who will not.
Is Cloudflare Tunnel safe for streaming Jellyfin? It is encrypted end to end and sits behind Cloudflare’s DDoS protection, but sustained high-bitrate streaming through the free tier runs into a gray area of Cloudflare’s terms of service. For occasional remote viewing it works fine; for a server that streams for hours daily, a mesh VPN avoids the question entirely.
Do I still need dynamic DNS if I use one of these tools? No. Every option here replaces the need for a stable public IP or a dynamic DNS record, because the connection routes through the tool’s relay or coordination server instead of a direct address on the home router.
Can I share my Jellyfin server with someone who will not install an app? Cloudflare Tunnel and Tailscale Funnel both work over a plain HTTPS link with no client required on the viewer’s side. Every mesh VPN option on this list needs a client installed on each device that connects.
Does CGNAT block all of these options? No. CGNAT only blocks inbound connections, which is exactly what port forwarding needs and none of these tools rely on. Every app here works by having the Jellyfin server dial out to a relay or coordination server, a connection type CGNAT does not interfere with.
Is Tailscale free for personal use? Yes. The Personal plan covers up to 6 users with unlimited devices per user, which is enough for most households plus a few friends or family members.