Jellyfin runs fine on your home network, but streaming it from outside the house fails because your ISP uses carrier-grade NAT and normal port forwarding never reaches your server. NeedPorts gives Jellyfin a stable public endpoint over an outbound tunnel.
Jellyfin listens on your LAN just fine, but the block is at the network edge. When your ISP puts you behind CGNAT you share a public IP with many other subscribers, so an inbound connection to your media server has nowhere to land even when your router forwarding rule looks correct.
Play your movies, shows, and music from a phone, TV, or laptop while away from home, without a VPN on every client device.
The router forward looks right, but remote clients time out because the ISP CGNAT layer drops unsolicited inbound traffic before it reaches your router.
NeedPorts gives you dedicated public ports over an outbound tunnel, so nothing depends on your ISP or router. After install, map one of your assigned ports to Jellyfin (local port 8096) and restart:
sudo needports use jellyfin <assigned-port>
sudo needports restartYour Jellyfin instance is then reachable at your dedicated public endpoint, for example your-server:30000, with no port forwarding on the local network.
Jellyfin has its own user accounts, so keep them strong and unique. Serve it over HTTPS where possible and avoid exposing admin-only features publicly. Only publish the Jellyfin port, not unrelated services on the same machine.
After mapping the Jellyfin port, open the public endpoint from a phone on cellular data (not home Wi-Fi) and confirm the login page loads. That proves inbound reachability before you rely on it for streaming.
NeedPorts plans start at $5/month or $30/year for 25 dedicated ports, which is plenty for Jellyfin and other self-hosted services on the same box.