Remote Access
Remote Access connects you to your self-hosted Cardinal Media Server from anywhere. The service is designed to be flexible, to support all kinds of different self-hosted setups. Users who are comfortable with port forwarding can set up powerful, secure direct connections, while users who cannot or choose to not forward a port can still access their apps remotely with other options like the cloud-hosted media apps or the relay connection.
When enabled, your Media Server keeps a connection open to Cardinal Cloud, which does three things for you: it hands your server a TLS certificate so its connections are properly encrypted, it gives your server a memorable address, and it tells your apps how to reach it from wherever they happen to be. Your media itself only travels through Cardinal when there is no way for an app to reach your server on its own.
Connection methods
| Method | What it is | Example address | Bandwidth |
|---|---|---|---|
| Direct Connection — local | A connection across your own network, for apps that are at home | https://192-168-1-40.abc123.connect.cardinalapps.host:24900 | Unmetered |
| Direct Connection — public | A connection from the internet, through your router, to your server | https://abc123.connect.cardinalapps.host:24900 | Unmetered |
| Relay Connection | Traffic forwarded through Cardinal's servers, for networks that cannot accept an incoming connection | https://relay.cardinalapps.host/relay/abc123 | Metered |
| Cloud-hosted apps | The Music, Photos and Cinema web apps, run by Cardinal, so you can reach your server from any browser with nothing installed | https://music.cardinalapps.io | Depends on the route the app takes |
The addresses above use abc123 as a stand-in for your server's own identifier, and the port your deployment publishes — 24900 in the Quick Start. A custom address replaces that identifier with a name you pick, so the public one reads https://brianflix.connect.cardinalapps.host instead.
Two of them are worth a second look:
- The local address is a public hostname that resolves to a private one.
192-168-1-40.abc123.connect.cardinalapps.hostdecodes to192.168.1.40, your server's address on your own network. That is what lets a connection which never leaves your house still be encrypted with a real certificate. It is not the same as openinghttp://192.168.1.40:24900yourself — that works too, and always has, but it is plain local access with no Remote Access and no encryption in it. - The relay address is for apps, not for you. Every relayed request has to carry your account's token, which a browser does not send when you type an address into it. Apps use this address; you never need to.
Apps do not choose between the connection types by hand, and neither do you. Every Cardinal app — your own self-hosted ones and the cloud-hosted ones alike — asks Cardinal Cloud how to reach your server, then tries the routes in order, taking the first that answers: local first, then public, then the relay.
Routes are chosen per connection, so nothing is stuck. A server that starts out relayed switches to direct the moment a direct route works, and an app that travels between your home and the outside world moves between local and public routes on its own.
Turning it on
- Sign in to your Media Server's Admin Dashboard with your Cardinal account.
- Go to Cloud Services and find the Remote Access card.
- Enable it.
Once your server is connected, Configure opens the drawer where both connection methods are switched on and off independently, your addresses are shown and copied, and a custom address is claimed.
What Remote Access does not do
- It is not needed on your own network. Your Media Server was always reachable at its local address, and it stays that way whether Remote Access is on, off, or waiting on a certificate.
- It is not a VPN. It carries traffic to your Media Server, and to nothing else on your network.
- It does not serve your own domain. Running your Media Server at a domain of your own, with your own DNS and your own TLS certificate, is a separate setup that Remote Access has no part in — see Custom domains and reverse proxies. The two coexist happily on one server.
- It does not put your media in the cloud. Direct connections never touch Cardinal's infrastructure at all. Your media stays exactly where you set it up.
Turning it off
Disabling Remote Access on the card stops your server being reachable from outside your network, and its remote addresses stop working. Your instance ID, hostname and certificate are not lost — turning it back on resumes at the same address.
Setting up Remote Access
- Direct Connection — your hostname and certificate, port forwarding, and custom addresses
- Relay Connection — how the relay works, what it costs, and its limits
- Cloud-hosted apps — reaching your server from a browser, with nothing to install
- Troubleshooting — connections stuck on the relay, DNS rebinding protection, public URLs that time out at home, and custom addresses that never come up
Was this article helpful?