Security for Plex

[comptontrent]

This post got a little long on me so feel free to skip the intro, as this is also my introduction to the forum, and go straight to my questions at the end. Otherwise, read on as I hope my experience may be useful to others looking to use FreeNas for their home server.

One day about 1 ½ to 2 years ago I looked at my 2TB external drive connected to my laptop and thought, “Wouldn’t it be great to have a central storage device connected to my router that all my network enable devices could access 24/7”. I looked at my modem/router and saw it had a USB connection and promptly plugged in my hard drive. I briefly thought I was onto something when a storage icon appeared in my network folder, but alas it was not accessible. At that time I was still NAS ignorant but knew there had to be a solution. Through much Googling I learned about NAS systems which then led to media servers like Plex. It was perfect, all this technology already existed and it was everything I wanted. Then I found FreeNAS, the Holy Grail of DIY’ers! I was so excited I immediately built a test box from an old Dell 32 bit Pentium III; maxed out the RAM at a whopping 4GB and a single 120GB hard drive. I installed FreeNAS and amazingly it worked, bad sectors on the hard drive and all. I was even able to install Plex and streamed a movie I transcoded to work with iTunes. Well, life got in the way and I never got around to actually building a production unit. This was fortunate because I would have made many poor decisions regarding hardware like using regular RAM and non-server grade components. Since those early days I’ve done more reading and I think I have a better understanding of using the correct hardware and basic configuration but I still have a long way to go in in things like security. I highly recommend to all newbies that may read this do your homework and take all the hardware recommendations seriously if you value your data. There are a lot of examples of bad things happening to people who choose to ignore them or just didn’t take the time to learn.

Enough about me, if you made it this far I hope you continue reading since I do have a few questions at the end. I’ve listed my planned usage, system requirements, build specs, and questions below.

Planned System Uses

• Personal data storage
  • Primarily movies, pictures, music, and home video; all the stuff that comes with having a family.
• Media server
  • Plex which I would like to make accessible from outside my network and possibly even setup sharing so parents and can easily view pictures and home videos of their grandkids.
• At this time I don’t plan to use OwnCloud or make the box accessible to the internet (behind a firewall of course) except as mentioned above about Plex. That said I have a questions below about Plex security below.

System requirements

• My current storage need is about 2TB and I want plenty of room to grow so I plan to use 6 x 2TB WD Reds in RaidZ2. This should give me about 6.25TB, give or take, of usable storage accounting for the loss to the pool and that ZFS recommends max 80% usage.
• Transcoding – all my movies are in MKV format (except for a few I transcoded to work on iTunes) and since I’m a little lazy I don’t feel like transcoding the rest hence the Xeon cpu for multiple HD transcoding.

Planned system

• Mobo – Supermicro X10SLL+-F (purchased)
• CPU – Xeon E3-1231V3
• RAM – 32 GB ECC RAM – 2 x Crucial CT2KIT102472BD160B (purchased)
• Storage – 6 x 2TB WD Red in RaidZ2
• PSU – Seasonic G 550W 80+ Gold
• Case – Fractal Design Arc Mini R2
  • Replacing stock fans (mostly for PWM) with:
    • 2 x Noctua NF-F12 PWM high pressure intake fans on the drives
    • 1 x Noctua NF-A14 PWM low pressure, high volume intake fan
    • 1 x Noctua NF-F12 PWM low pressure, high volume exhaust fan
• UPS – Haven’t picked one out yet. Any suggestions would be helpful!

Current network layout

• All-in-one modem WIFI router with firewall purchased from ISP attached to a TP-LINK 24-Port unmanaged gigabit Ethernet switch (TL-SG1024).
• I have at least 2 Cat5e drops in every room, more in the office and entertainment areas. Trying to get as many stationary Ethernet capable devices (smart TV, Apple TV, etc.) off WIFI as possible.

Questions

1. Are there security concerns making Plex accessible from outside my home network by turning on “Make Plex Accessible”? I know it’s possible since I did it with my test box but I swear I read a post advising against it; maybe things have changed.
2. If #1 is acceptable, are there any other security concerns sharing Plex with other users from outside my network?
3. If Plex security is an issue can anyone suggest best practices for making it secure, i.e. SSL, certificates, etc.?
4. Based on my expected usage and setup would there be a benefit going to a separate modem router configuration, i.e. pfsense?

Thank you for reading and any responses.

 

[SweetAndLow]

For the most part Plex is secure and you shouldn't have to worry about it.

 

[SmallGuy]

https://support.plex.tv/hc/en-us/articles/206225077-How-to-Use-Secure-Server-Connections

 

[danb35]

https://forums.freenas.org/index.php?threads/system-compromised.43081/#post-282185

 

[comptontrent]

Thanks for the info!

 

[raidflex]

You could also setup a PFsense firewall and enable something like Snort or Suricata to protect your network with open ports. Generally though Plex should be secure.