

Not spesifically helpful with your cgnat-situation, but my jellyfin runs on a isolated network and it’s just directly exposed to the internet via named reverse proxy in order to share the library with family and friends. Should someone get access to that they can obviously use the VM for nefarious purposes, but it’s a known risk for me and the attacker would need to breach trough either my VLAN isolation or out of the virtual environment to my proxmox host if they wanted to access my actually valuable data.
Sure, there’s bots trying every imaginable password combination and such, but in my scenario even if they could breach either the jellyfin server or reverse proxy it’s not that big of a deal. Obviously I keep the setup updated and do my best to keep bad actors out. but as I mentioned, breach for that one server would not be the end of the world.
With cgnat there’s not much else to do than to run a VPN where server is somewhere publicly accessible and route traffic via that tunnel (obviously running a VPN-client on jellyfin-server or otherwise routing traffic to it via VPN). Any common VPN-server should do the trick.



Not even that long ago I dreamt of travelling to the US and see grand canyon and other natural wonders, drive on road 66 or atleast get a feeling of how the idealistic image of USA painted my movies/music/etc actually is, maybe visit burning man and so on. Now the plan is to stay the fuck out of there unless things change drastically.
Gladly there’s a crapload of other places to visit, Kyiv is on my bucket list once things calm down there.