August 21, 2025Aug 21 Hi guys,I've been banging my head against the walls trying to figure out what the hell might be making Plex's remote access unhappy.I have a static IP, and normally my ISP shouldn't be doing CGNAT, but for some reason, things aren't working.Now that I figured out that by default, Wireguard on UnRaid means "everyone gets wireguard", Plex's connection checker is correctly reporting my external IP.canyouseeme.org reports the port as closed.The OpnSense rule is copied from another sever I have running on another port. That one reports as open, no problem, which would point to the issue being with UnRaid. I've checked the rules multiple times. I've edited the source rule with the IP to the UnRaid server, and swapped ports around inside of Plex: port closed from canyouseeme.Here's iptables on the UnRaid box:root@Tower:~# iptables -L -nChain INPUT (policy ACCEPT)target prot opt source destinationChain FORWARD (policy ACCEPT)target prot opt source destinationDOCKER-USER all -- 0.0.0.0/0 0.0.0.0/0DOCKER-ISOLATION-STAGE-1 all -- 0.0.0.0/0 0.0.0.0/0ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHEDDOCKER all -- 0.0.0.0/0 0.0.0.0/0ACCEPT all -- 0.0.0.0/0 0.0.0.0/0ACCEPT all -- 0.0.0.0/0 0.0.0.0/0ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHEDDOCKER all -- 0.0.0.0/0 0.0.0.0/0ACCEPT all -- 0.0.0.0/0 0.0.0.0/0ACCEPT all -- 0.0.0.0/0 0.0.0.0/0WIREGUARD all -- 0.0.0.0/0 0.0.0.0/0Chain OUTPUT (policy ACCEPT)target prot opt source destinationChain DOCKER (2 references)target prot opt source destinationACCEPT tcp -- 0.0.0.0/0 172.31.200.2 tcp dpt:8989ACCEPT tcp -- 0.0.0.0/0 172.31.200.2 tcp dpt:9897ACCEPT tcp -- 0.0.0.0/0 172.17.0.2 tcp dpt:9696ACCEPT tcp -- 0.0.0.0/0 172.17.0.3 tcp dpt:5055ACCEPT tcp -- 0.0.0.0/0 172.31.200.3 tcp dpt:6789ACCEPT tcp -- 0.0.0.0/0 172.31.200.4 tcp dpt:7878ACCEPT tcp -- 0.0.0.0/0 172.31.200.5 tcp dpt:8989Chain DOCKER-ISOLATION-STAGE-1 (1 references)target prot opt source destinationDOCKER-ISOLATION-STAGE-2 all -- 0.0.0.0/0 0.0.0.0/0DOCKER-ISOLATION-STAGE-2 all -- 0.0.0.0/0 0.0.0.0/0RETURN all -- 0.0.0.0/0 0.0.0.0/0Chain DOCKER-ISOLATION-STAGE-2 (2 references)target prot opt source destinationDROP all -- 0.0.0.0/0 0.0.0.0/0DROP all -- 0.0.0.0/0 0.0.0.0/0RETURN all -- 0.0.0.0/0 0.0.0.0/0Chain DOCKER-USER (1 references)target prot opt source destinationRETURN all -- 0.0.0.0/0 0.0.0.0/0Chain WIREGUARD (1 references)target prot opt source destinationHere's ss on the UnRaid box:root@Tower:~# ss -tuln | grep 32400tcp LISTEN 0 1024 0.0.0.0:32400 0.0.0.0:*Here's from inside the docker:# awk 'NR>1 && $4=="0A" && toupper(substr($2,10,4))=="7E90"{print "LISTEN on port 32400 (row:",$0,")"}' /proc/net/tcpLISTEN on port 32400 (row: 19: 00000000:7E90 00000000:0000 0A 00000000:00000000 00:00000000 00000000 99 0 27804597 1 000000001f001745 100 0 0 10 0 )Anyone got a clue as to what I might be missing here ? Edited August 21, 2025Aug 21 by batscarfacehypernova
August 21, 2025Aug 21 What docker network is the plex container assign to? You should use host or macvlan/ipvlan.
August 21, 2025Aug 21 Author 20 minutes ago, pkoci said:What docker network is the plex container assign to? You should use host or macvlan/ipvlan.It's assigned to host. I've tried the others as well, as well as assigning it directly to the network interface and giving it its own ip.
October 2, 2025Oct 2 I have this same issue and it's something with OPNsense. My OPNsense router cannot ping any container when it's using br0/ipvlan, but when set to host, it can. Any physical box on my network can ping the containers. It's something in OPNsense and I can't figure it out.Did you ever solve this? The only thing that is solving it right now for me is to use host but I'd rather use br0/ipvlan.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.