Hello,
Over the past few months I have posted several times regarding an issue I experienced when upgrading the version of Plex media server. I believe the issue is related to my firewall ruleset so was hoping to get some help. I will do my best to explain what I have experienced:
Several months ago I had a webserver configured with a few different jails. Apache on one jail, an irc server on another, and finally a jail dedicated for plex. My ruleset (below) seemed to be just fine for what I needed. After upgrading plex it would not longer respond. I posted on these forums and received a lot of different recommendations and similar on the plex forums. To make a long story short I abandoned my setup (10.1-Release) and switched to Stable so that I could use bhyve(8) since I have an AMD CPU and required the last version. I got everything set up with bhyve(8) now but am having the same exact issue (seems to be at least) where plex works only when I turn off my firewall. Once enabled, plex does not respond.
Ultimately I would prefer to revert back to 10.1-RELEASE and use sysutils/ezjail instead of use bhyve(8). I plan to spin up a Release install and test this out again but am fairly confident that it will work once the firewall is turned off so I do not think I NEED to use bhyve(8).
A few things to note:
Thanks in advance!
Over the past few months I have posted several times regarding an issue I experienced when upgrading the version of Plex media server. I believe the issue is related to my firewall ruleset so was hoping to get some help. I will do my best to explain what I have experienced:
Several months ago I had a webserver configured with a few different jails. Apache on one jail, an irc server on another, and finally a jail dedicated for plex. My ruleset (below) seemed to be just fine for what I needed. After upgrading plex it would not longer respond. I posted on these forums and received a lot of different recommendations and similar on the plex forums. To make a long story short I abandoned my setup (10.1-Release) and switched to Stable so that I could use bhyve(8) since I have an AMD CPU and required the last version. I got everything set up with bhyve(8) now but am having the same exact issue (seems to be at least) where plex works only when I turn off my firewall. Once enabled, plex does not respond.
Ultimately I would prefer to revert back to 10.1-RELEASE and use sysutils/ezjail instead of use bhyve(8). I plan to spin up a Release install and test this out again but am fairly confident that it will work once the firewall is turned off so I do not think I NEED to use bhyve(8).
A few things to note:
- I am not sure if this is related or not but I just noticed that my /var/unbound/unbound.conf cannot be read. The permissions are showing read by everyone and write for root, so not sure why that is an issue.
- My firewall ruleset is not leveraging the bridge/tap interfaces required for bhyve(8) as shown in the handbook (https://www.freebsd.org/doc/handbook/virtualization-host-bhyve.html). I would imagine I should be using these if I stick with bhyve(8) which is the primary reason I would rather keep my system set up the way it was previously and stick with sysutils/ezjail.
- My ruleset is pretty old, and probably has a lot of room for improvement. Any input would be greatly appreciated.
- I prefer to use jails over bhyve(8) but just want plex to work regardless, so whichever is preferred please let me know. I think I just need help tweaking my ruleset but would expect that solution will differ depending on which environment plex is running inside.
- This is the documentation for firewall port forwarding from plex: https://support.plex.tv/hc/en-us/ar...ports-do-I-need-to-allow-through-my-firewall-
Code:
brad@mercury:/home/brad$ cat /etc/pf.conf
set skip on lo0
interface="re1"
apacheJail="192.168.0.102"
ircJail="192.168.0.103"
virtualPlex="192.168.0.104"
scrub in all
rdr pass on $interface proto tcp from any to $interface port 80-> $apacheJail
rdr pass on $interface proto tcp from any to $interface port 6667-> $ircJail
rdr pass on $interface proto tcp from any to $interface port 32400-> $virtualPlex
rdr pass on $interface proto udp from any to $interface port 1900-> $virtualPlex
rdr pass on $interface proto tcp from any to $interface port 3005-> $virtualPlex
rdr pass on $interface proto udp from any to $interface port 5353-> $virtualPlex
rdr pass on $interface proto tcp from any to $interface port 8324-> $virtualPlex
rdr pass on $interface proto udp from any to $interface port 32410-> $virtualPlex
rdr pass on $interface proto udp from any to $interface port 32412-> $virtualPlex
rdr pass on $interface proto udp from any to $interface port 32413-> $virtualPlex
rdr pass on $interface proto udp from any to $interface port 32414-> $virtualPlex
rdr pass on $interface proto tcp from any to $interface port 32469-> $virtualPlex
block in on $interface
pass in on $interface proto tcp from any to any port 2662
passout on $interface proto {tcp,udp,icmp} all
Last edited:
Can you or someone help me write these rules in a better way so that I can get this setup working? I am most likely going to format and switch back to 10.1 Release for the time being as playing around in Stable is most likely not a good idea...however, I am wondering if I can get the plex jail to work in 10.1 Release again. My guess is that it can certainly be done but my fw rules need to be updated.