Live

Plex remote access without port forwarding.

Portless gives your Plex Media Server a stable HTTPS URL that works behind CGNAT, double NAT, blocked port 32400, and dynamic IPs. Your server connects outbound on 443, so there is no router setup, no DDNS, and no VPN app for viewers.

Get your subdomain See how it works

Works behind CGNAT and double NAT Real TLS certificates Plex Relay alternative

Your Plex server

192.168.1.42:32400

outbound

udp/quic 443

Portless edge

tunnel online

https

public

Anywhere

browser · phone · tv

https://yourname.portless.io

plex remote access fixes

Plex remote access problems Portless solves

If Plex says your server is not available outside your network, the root cause is usually NAT, blocked ports, or changing home internet. Portless bypasses the inbound networking step entirely.

Plex remote access not working

Keep Plex on your home server and publish it through a stable HTTPS URL instead of fighting router discovery.

No port forwarding for Plex

Your daemon connects out to Portless. You do not open inbound ports or expose your router admin surface.

CGNAT or double NAT

Carrier-grade NAT and nested routers block normal inbound connections. Outbound 443 still works on most residential networks.

ISP blocks port 32400

Portless does not depend on Plex's default inbound port. The public side is browser-trusted HTTPS.

Dynamic IP breaks Plex

Your Portless subdomain stays stable even when your home public IP changes after a reboot or ISP lease renewal.

Plex Relay is too slow

Portless is a per-account tunnel for self-hosted Plex, built for normal Plex clients and long streaming requests.

how it works

Three steps to remote Plex access

Your server makes one outbound connection. We give you a public HTTPS URL. That's the whole product.

Claim a subdomain

Sign in with your email and pick a name. You get https://yourname.portless.io with automatic TLS, yours for as long as your account is active.

Run the daemon

Drop the Portless daemon next to your Plex server with Docker, unRAID, Synology, or a bare-metal service. One environment variable, one token, one outbound connection. No router config, no firewall changes.

Stream from anywhere

Use your normal Plex clients with a public HTTPS server URL — Roku, Fire TV, Apple TV, smart TV, console, phone, browser. No port forwarding, no DDNS, no NAT loopback gymnastics.

why portless

Built for self-hosters on real internet

Six things you should expect from a tunnel for Plex. We built around them.

Real TLS by default

Browser-trusted certificates, renewed transparently at the edge. No mixed-content warnings on Plex web, no profile prompts on iOS.

Works behind CGNAT

Carrier-grade NAT, double NAT, blocked port 32400 — none of it matters as long as the server can reach Portless on outbound UDP 443.

Quick setup

One token. One container. No router config, no inbound firewall changes, no DNS edits.

Customer-run daemon

The daemon runs next to Plex in your own Docker stack. Its source is public, and published images are signed with build provenance and SBOM attestations.

No viewer VPN app

The server owner runs Portless. Viewers use Plex without installing a Portless app, joining a VPN, or managing a tailnet invite.

Minimal tunnel metadata

The edge terminates browser-trusted TLS for your subdomain, then forwards requests to your daemon over mTLS QUIC. Portless records operational and billing metadata such as bytes, status, timings, and sanitized route class.

compare options

Portless vs Plex Relay, Tailscale, Cloudflare Tunnel, and port forwarding

Those tools all solve real problems. Portless is narrower: remote Plex access for self-hosters who need a public URL without router changes.

option best fit tradeoff

Plex Relay Built into Plex and useful as a fallback. Stream quality is constrained; it is not meant to replace normal remote access.

Port forwarding Works when your ISP and router allow inbound 32400. Breaks under CGNAT, double NAT, blocked ports, dynamic IPs, or strict firewalls.

Tailscale Excellent for your own trusted devices. Viewers usually need tailnet access or a separate public-facing setup.

Cloudflare Tunnel Strong general-purpose HTTP tunneling. General-purpose tunnels are not positioned around Plex streaming behavior.

Portless Stable HTTPS URL for Plex with no port forwarding, no DDNS, and no viewer VPN app. Designed for self-hosted Plex transit; you still run and secure your own Plex server.

quickstart

Get your tunnel — start free trial

Sign in, claim a subdomain, paste one Docker command. The daemon connects outbound on UDP 443 — no inbound ports, no firewall changes, no DNS edits.

terminal

# 1. Run the Portless daemon next to Plex
docker run -d --name portless --restart unless-stopped \
  -v portless-data:/var/lib/portless \
  -e PORTLESS_DEVICE_TOKEN=$YOUR_TOKEN \
  -e PORTLESS_PMS_URL=http://192.168.1.42:32400 \
  ghcr.io/crbl-technologies/portless-client:latest

# 2. Open your subdomain — that's it
open https://yourname.portless.io

faq

Common questions

Short answers. Full picture lives in our Terms, Privacy, and Abuse docs.

How is this different from Plex Relay?

Plex Relay caps every stream at 2 Mbps, even on Plex Pass. Portless uses a separate per-account tunnel without that ceiling. Direct-play capacity still depends on your Plex server, home upload, relay, and viewer network.

Does this violate Plex's Terms of Service?

Portless is designed as transit, not as a Plex client or automation layer. Our servers don't authenticate to Plex, don't call Plex APIs, don't establish Plex sessions, and don't register clients; Plex's own terms still apply to how you run your server and who you authorize in Plex.

Why not Tailscale, Cloudflare Tunnel, or ngrok?

Tailscale is excellent for your own devices, but guests usually need tailnet access unless you use Funnel. Funnel is public-facing, but only on specific ports with non-configurable bandwidth limits. Cloudflare documents separate paid services for video and disproportionate large-object delivery. General-purpose tunnels are not tuned for Plex's range requests and long streams.

How much does it cost?

Portless Pro starts with a 7-day trial — Stripe collects your card and tax details, but you're not charged during the trial. After that, $2.99/mo or $29.99/yr (Save 16%). Pro includes 2 TB of transfer per monthly quota period.

Where does the daemon run?

The daemon runs in your environment next to Plex, usually as a Docker container. The relay and control plane are operated by CRBL Technologies.

Can I inspect the client?

Yes. The client source is public on GitHub, and published container images are signed with build provenance and SBOM attestations so the release path can be audited.

Start your tunnel — 7 days free

One email, one container, one stable URL. Cancel from the Stripe portal during the trial and you will not be charged.

Start free trial See how it works