Accessing your Navidrome music server from the internet requires configuring both your router’s port forwarding rules and Nginx’s reverse proxy settings correctly. This guide explains how to expose the service securely using standard HTTP ports while ensuring local LAN access remains unaffected by external network changes.
Understanding the Network Architecture
Before modifying any configurations, it is essential to understand how traffic flows through your Raspberry Pi. When you access Navidrome on your Local Area Network (LAN), you typically use a private IP address such as
192.168.1.x. In this scenario, Nginx listens on localhost and forwards requests to the Navidrome backend, which usually runs on port
4533. However, when accessing the service from the public internet, your home router receives incoming traffic on your public IP address. The router must then forward specific external ports to the internal IP of your Raspberry Pi.
The critical distinction here is that Nginx acts as a gateway. It does not need to know about the internal port
4533 for external users; instead, external users only interact with Nginx on standard web ports. This separation ensures that your actual application server is not directly exposed to the raw internet, adding a layer of security and flexibility. If you are experiencing issues with connectivity or cursor visibility on your Pi interface, you might find our guide on
OpenBox Hides Cursor on Raspberry Pi: A Tech Support Query helpful for general system stability, though it does not directly impact network routing.
Configuring Router Port Forwarding
The first step in making your server accessible globally is to configure your home router. Most consumer routers block incoming connections by default for security reasons. You need to create a rule that directs traffic arriving at your public IP on specific ports to the local IP address of your Raspberry Pi.
Log into your router’s administration panel. Look for sections labeled "Port Forwarding," "Virtual Server," or "NAT." Create a new entry with the following parameters:
- External Port: Set this to
80 for HTTP or 443 for HTTPS. Using standard ports allows users to access your server without specifying a port number in the URL.
- Internal IP Address: Enter the static local IP address assigned to your Raspberry Pi. Ensure this IP is reserved in your router’s DHCP settings so it does not change after a reboot.
- Internal Port: This should match the port Nginx is listening on locally, typically
80 or 443, not the Navidrome backend port.
- Protocol: Select TCP.
Save the settings and restart the router if necessary. It is important to note that exposing port
4533 directly to the internet is unnecessary and insecure because Nginx handles the termination of external connections. Only ports
80 and
443 should be exposed externally to maintain a secure architecture.
Nginx Reverse Proxy Configuration
Once the router is configured, you must ensure Nginx is properly set up to handle incoming requests and pass them to Navidrome. Create or edit a server block configuration file for your site, typically located in
/etc/nginx/sites-available/.
Your configuration should include a server block that listens on port
80 and uses the
proxy_pass directive to forward traffic to
http://127.0.0.1:4533. Additionally, you must include headers that inform Navidrome of the correct host and scheme. Without these headers, Navidrome may generate links using
localhost or incorrect protocols, breaking the experience for remote users.
server {
listen 80;
server_name your-domain.com;
location / {
proxy_pass http://127.0.0.1:4533;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
After editing the file, test the configuration for syntax errors using
sudo nginx -t. If the test passes, reload Nginx with
sudo systemctl reload nginx. This setup ensures that whether the request comes from inside your home or across the globe, Nginx correctly translates the request for Navidrome. For more details on managing network interfaces on Ubuntu-based systems, consider reviewing
Setting Up Port Forwarding on Ubuntu: A Comprehensive Guide, which covers broader networking concepts applicable to your setup.
Verifying External Access and Security
To verify that your setup works, use a mobile device disconnected from your Wi-Fi network and attempt to access your server via your public IP address or domain name. If the connection fails, check your router’s log to see if packets are being dropped. Common issues include ISP blocking residential ports or dynamic DNS misconfigurations.
For enhanced security, consider setting up SSL/TLS certificates using Let's Encrypt. This encrypts traffic between the client and your Nginx proxy. While Navidrome itself does not handle TLS in this reverse proxy model, Nginx can terminate the SSL connection, providing a secure channel for your music streaming. Ensure your firewall, such as UFW, only allows traffic on ports
80 and
443 from external sources. Internal traffic on other ports can remain unrestricted for local management. If you encounter SSH connectivity problems during your initial setup phase, refer to
Troubleshooting SSH Connection Issues on a Fresh Install of Ubuntu Server 23.10 on a Raspberry Pi to resolve authentication barriers before applying network changes.
Frequently Asked Questions
Why can I access Navidrome locally but not remotely?
This usually indicates that your router’s port forwarding rules are either missing or misconfigured. Verify that the external port maps to the correct internal IP and that the internal port points to Nginx, not directly to Navidrome’s backend port.
Is it safe to expose port 4533 to the internet?
No, it is not recommended. Exposing the backend port directly bypasses Nginx’s security features and header management. Always route external traffic through Nginx on standard web ports like 80 or 443.
How do I find my public IP address?
You can find your public IP by visiting a website like
whatismyipaddress.com from a device outside your local network, or by checking the WAN status page in your router’s admin panel.
Can I use IPv6 instead of IPv4 for port forwarding?
Yes, if your ISP provides IPv6, you can configure Nginx to listen on IPv6 addresses and update your router’s firewall rules accordingly. See our guide on
Set Up Public IPv6 on Ubuntu Server 22.04 and Raspberry Pi for detailed steps on enabling IPv6 connectivity.
What should I do if my public IP changes frequently?
Use a Dynamic DNS (DDNS) service to assign a consistent hostname to your changing IP address. Configure your router to update the DDNS provider automatically whenever the IP changes, allowing you to always access your server via the same domain name.