Navidrome remote access without port forwarding.

Two ways in that open nothing on your router, and how to choose.

By Nenad Jokic, who makes NaviBeat.

You can reach Navidrome away from home without opening a port on your router. The two usual ways are a Tailscale network and a Cloudflare Tunnel. Both start the connection from inside your house, so they also work behind CGNAT, where port forwarding does not work at all.

Why not port forwarding?

Port forwarding is the old way: a port on the router, a domain, a reverse proxy and a certificate. It works, but your server now faces the whole internet. And many home connections sit behind CGNAT, which means there is no public address to forward to.

Option 1: Tailscale

Tailscale puts your devices on one private network. Install it on the server and on each phone and computer, and use the server's tailnet address in your player, with port 4533.

  • Good: nothing is public, and setup takes minutes.
  • Bad: every device needs the VPN on. On a moving phone, each change of cell tower can freeze the tunnel for a while, and you hear that as a stutter.

Option 2: Cloudflare Tunnel

A small program, cloudflared, runs next to Navidrome and connects out to Cloudflare. You get a public address on your own domain, and it forwards to http://localhost:4533. Nothing opens on your router.

  • Good: no VPN on the phone, and a public address holds up better on a moving phone.
  • Bad: you need a domain, and your server is public, so use a strong password. Add Cloudflare Access if you want a second lock in front of it.

Which one should you pick?

If only you listen and you are mostly on Wi-Fi, take Tailscale. If you listen in the car, or other people use the server, take the tunnel.

Using it in NaviBeat

NaviBeat works with both. For a Cloudflare Access or Authelia login, add custom HTTP headers to the server. mTLS client certificates work too. You can set a home address and a remote address on one server, and Settings > Server & Library > Server addresses shows which route is active. All of this goes straight to your server, with no relay of mine in between.

If the car is the problem whatever you choose, download the album before you leave. More on stutter over a VPN.

Questions

Can I use Navidrome outside my home without port forwarding?

Yes. Tailscale and Cloudflare Tunnel both work without opening a port on your router, and both work behind CGNAT.

Is Tailscale or Cloudflare Tunnel better for Navidrome?

Tailscale is simpler and keeps the server private, but every device needs the VPN. A Cloudflare Tunnel gives you a public address and holds up better on a moving phone, but you need a domain and the server is public.

Does Navidrome work behind CGNAT?

Yes, with a method that connects outward from your house, such as Tailscale or a Cloudflare Tunnel. Port forwarding does not work behind CGNAT.