Remote access to your media server, without opening a port

To watch your own library from outside the house you need one of three things: a port forwarded on your router, a private network that both ends join, or a relay the server dials out to, so nothing at home has to be opened. Which of the three you can actually use depends less on how technical you are than on what your provider gave you when the line was installed.

Why the old advice quietly stopped working

For a long time the standard answer was a forwarded port. That assumes the router at home has a public IPv4 address, and an increasing number don’t. With carrier-grade NAT the provider puts hundreds of subscribers behind one address. Your router accepts the rule, the firewall is right, the dynamic DNS name resolves, and the connection still never arrives, because the address you forwarded on isn’t the one the internet sees.

Is your line one of them? You can check in a minute: look at the WAN address the router reports for itself. Anything from 100.64 to 100.127 is the range RFC 6598 reserves for exactly this arrangement, and it means the address the internet sees isn’t yours to forward. Mobile lines, fixed wireless and a good share of the newer fibre contracts land there by default. Some providers will give you a public address if you ask, some will charge for it, and some will refuse.

Double NAT causes the same symptom closer to home, usually when the provider’s router feeds a second router somebody bought themselves. You can fix that one by putting the first router into bridge mode or moving the forward to it; the carrier-grade version isn’t yours to fix.

The three routes, and what each asks of you

Route	What you set up	What it exposes	Behind CGNAT	Cost
Port forwarding	Router rule, dynamic DNS, a certificate you keep renewed	A public address and one open port	Does not work	Free
Private network	WireGuard or Tailscale on the server and on every device that watches	Nothing publicly	Works	Free
Managed relay	One switch in the server settings	Nothing publicly	Works	Pro

A forwarded port is still the best option when your line allows it, and it’s the oldest way to reach a self-hosted media server. Nothing sits between you and your own hardware, the bandwidth is whatever your uplink can push, and you aren’t trusting anyone else. It also means a login page that anyone scanning that address can reach, so the server has to be kept patched, which is a chore, and no more than that.

An overlay network such as WireGuard or Tailscale works very well for a laptop or a phone, where installing it takes a few minutes. It works much less well when the device is a television or a set-top box in someone else’s flat, because there’s usually no way to install anything on it.

The relay is the one that asks least of you. The server opens the connection outward, the way any application does, and clients meet it on the far side. There’s no rule to write, no certificate to renew and no address of yours published anywhere. Quven never asks your router to open anything on your behalf, and there’s no UPnP code in the server that could.

What a relay actually does to the picture

A relayed session travels further than a local one, and a player that ignores that will stall.

A remote session the server has to re-encode is held at 25 Mbps and 2160p. There’s one quality setting, which you choose and can step down by hand. We didn’t build an automatic ladder, because in our testing a ladder that decides for you tends to pick wrong on exactly the film you cared about.

The browser client reads its media on a different path and isn’t held to that ceiling, and getting there took a measurement. Every segment request over the relay costs about 117 milliseconds before the first byte arrives, so a player that asks for one segment, waits, then asks for the next spends most of its time waiting. Reading ahead by two segments, with two requests in flight, took a session that had been pinned at 720p up to the full 4K source at about 8.8 Mbit/s with no stalls, on the same line.

The desktop client never fetches segments at all. It reads the file in ranges, the way a local player reads a disc, and the lever that matters there is how far ahead of the picture it buffers.

The part nobody asks about until later

The relay terminates the encryption and forwards your session on. While the bytes are in flight, the relay can see them. It’s built not to log them, and nothing about your library is stored or profiled on the way through; the relay is a path to your server, and it never holds a copy of anything. If you’d rather not make that trade, the self-hosted route is free and supported, and will remain so. What we keep local, and why, is set out in what stays on your own machine.

Frequently asked questions

Do I need a static IP address to watch my library away from home?

No. A static address only helps with port forwarding, and dynamic DNS covers that well enough. A private network and the managed relay both work on an ordinary residential connection whose address changes every time the router reboots.

Is a VPN safer than a managed relay?

For a laptop, yes, and by a meaningful margin, because nothing between the two ends can read the traffic. The comparison changes once the device is a television or a guest’s phone. There, the realistic alternative to a relay is usually no remote access at all.

Why does a film look softer away from home than it does on the sofa?

Because the ceiling is your upload speed at home, and your hotel’s download speed has nothing to do with it. A 60 Mbps fibre line often uploads at 10, and a 4K remux wants more than that, which is why a server transcodes at all. Quven shows you what it settled on, so you can drop a rung and stop guessing.

Can I keep my own port forward and use the relay too?

Yes. They’re separate routes to the same server and neither one disables the other. Clients on your local network keep talking to the server directly and never touch either.