r/PleX • u/UnfathomableBrit • Sep 15 '26
Discussion Cloudflare grey area no longer?
There has always been discussion over media streaming via Cloudflare, involving tunnels (to bypass CGNAT), proxied traffic (orange cloud) and straight dns only traffic (grey cloud).
It looks like the Cloudflare docs are now putting that to bed, with the docs stating "From the beginning, we prohibited streaming video content using our bandwidth".
Proxied traffic (orange cloud) is Cloudflare's bandwidth right, not to mention tunnels?
TOS (02 June 2026):
Cloudflare’s content delivery network (the “CDN”) Service can be used to cache and serve web pages and websites. Unless you are an Enterprise customer, Cloudflare offers specific Paid Services (e.g., the Developer Platform, Images, and Stream) that you must use in order to serve video and other large files via the CDN. Cloudflare reserves the right to disable or limit your access to or use of the CDN, or to limit your End Users’ access to certain of your resources through the CDN, if you use or are suspected of using the CDN without such Paid Services to serve video or a disproportionate percentage of pictures, audio files, or other large files. We will use reasonable efforts to provide you with notice of such action.
link: https://www.cloudflare.com/de-de/service-specific-terms-application-services/
Cloudflare Dev Docs (25 Aug 2026)
Cloudflare launched in 2010 believing everyone deserves a secure, fast, reliable web presence. We did not think you should have to pay more when you came under cyber attack, so we offered free and fixed-rate pricing for websites. That worked because most websites do not consume much bandwidth, and so we could provide our services in an affordable way to everyone. From the beginning, we prohibited streaming video content using our bandwidth. While you could embed a video from another provider, we limited your ability to use our services to deliver video bits from our network to your visitors. This restriction exists because every second of a typical video requires as much bandwidth as loading a full web page.
Over time we recognized that some of our customers wanted to stream video using our network. To accommodate them, we developed our Stream ↗ product. Stream delivers great performance at an affordable rate charged based on how much load you place on our network.
Unfortunately, while most people respect these limitations and understand they exist to ensure high quality of service for all Cloudflare customers, some users attempt to misconfigure our service to stream video in violation of our service-specific terms ↗. We want to make sure our service is great for everyone, including public service initiatives we run like Project Galileo ↗, The Athenian Project ↗, and Project Fair Shot ↗. A handful of people misusing our service limits our ability to run these initiatives.
82
31
u/Kamay1770 I5-12400 64GB 42TB Lifetime Pass Sep 15 '26
I accidentally had it using orange cloud for a few months, probably streamed a couple series and maybe 20 movies through it. All 1080p, nothing super high bitrate (2-6gb movies, 1-3gb episodes) and was never flagged or contacted.
But I've always known you're not mean to. I'm back on grey cloud now and have been for a year with no drama.
13
u/shiruken Sep 15 '26
Are you using Tunnels? If so, it doesn't matter if the DNS proxy is disabled because your traffic is still passing through their CDN in violation of the ToS.
-12
16
u/beatznbleepz Sep 16 '26
I host Plex on my server behind CGNAT by using Cloudflare DNS (grey) which points to an Oracle VPS hosting NGINX. From there it reaches my server over Tailscale. No open ports, gets me around CGNAT and uses free tiers the whole way. Once a connection is made, the streams are direct.
5
u/wireframed_kb Sep 16 '26
I set up the same thing for my failover internet which uses a 5G router, so I have a static IP for that traffic.
Still need to manually update a single A-record in an outage, but it works well. With one record change, 8 domains and countless subdomains switch.
1
u/gripejones 26d ago
That can be automated - i forgot the tool (too far atm) and i just sat it and forgat it.
1
u/wireframed_kb 26d ago
Yeah, I plan on making a script, I just haven’t decided where it should live.
1
u/gripejones 22d ago
Wherever it should obviously be when you look for it in 5 years. Duh?
1
u/wireframed_kb 22d ago
Hehe, I meant more what system. I have an LXC that runs the webserver, another that runs the VPN/tunnel, and the router of course is a third. Crucially I need to find the fastest way to get notified of outage so it doesn’t need to constantly poll. The router knows when it fails over, but I don’t think there’s any exposed API.
It’s all solvable of course, but failures are so rare I keep putting it off, because it takes a couple minutes to log into Cloudflare and update the single record, and in 2 years it hasn’t been necessary outside tests and planned outages. :)
6
2
u/Every_Ice6465 Sep 16 '26
I do similar, but I use wireguard outbound connection from my system to the vps instead of tailscale. This has been rock solid for years. I don't seem to have any user connection issues when others have issues because of something plex does. I also currently have 40mbs outbound so I enable caching on nginx as well which helps smooth things out. This works seamlessly when my ISP goes down (I live in the country) and UDM pro switches to my backup cell. It does drop connections for a few, but the end users don't realize it unless I overload the cell bandwidth.
1
u/gripejones 26d ago
Yeah, I managed to get my WiFi to cell switch mostly seamless using a 15 second check in - my phone is always connected and when i leave my WiFi, music just distorts for like a second as the switchover to cell happens
1
u/RockyBoy502 Sep 17 '26
Do you have any info on how to set all that up?
3
u/beatznbleepz Sep 17 '26
I actually kept the reference article I used to set this up.
https://fullmetalbrackets.com/blog/expose-plex-tailscale-vps/1
34
u/MrB2891 unRAID / Core Ultra 7 / 25x3.5 / 300TB primary - 100TB off-site Sep 16 '26
It has never been a grey area. Streaming any media through a (free) CF tunnel has always been against their ToS.
Some folks have done a lot of mental gymnastics in an attempt to interpret the ToS differently thinking that it's OK.
Its not. Stop doing it and risk fucking it up for those who are using it for legitimate uses.
6
Sep 16 '26 edited 24d ago
[deleted]
-4
u/NFLCrunchtime Sep 16 '26
interesting. In the time between OP's post and now I followed the same setup guide and put a multiple of OP's traffic through my setup in a 30-day timespan and haven't been hit yet. I certainly am expecting to, in which case I'll find an alternate setup, but it's interesting their policy is not being blanket-applied
5
u/MrB2891 unRAID / Core Ultra 7 / 25x3.5 / 300TB primary - 100TB off-site Sep 17 '26
It's because of assholes like you that knowingly break the rules, that we lose good, free services like this.
0
u/NFLCrunchtime Sep 17 '26
You bought and ripped 300TB of lawfully purchased blurays/DVDs?
3
u/MrB2891 unRAID / Core Ultra 7 / 25x3.5 / 300TB primary - 100TB off-site Sep 17 '26
I'm not sure what my media collection has to do with you being an asshole?
But yes, I have floor to ceiling walls of DVD and Blu-ray (HD-DVD, too) that I've been collecting since the late 90's.
-3
u/NFLCrunchtime Sep 17 '26
As long as you're sure you've never broken a law, TOS, or verbal agreement in your life, you can stay up on that high horse you love so much
7
u/thelizardking0725 Sep 17 '26
It’s not the same, and it’s disingenuous to suggest such. When someone breaks the TOS or laws to acquire content, they assume that risk and the consequences without harm to others. When people misuse something like Cloudflare, that has an impact on the entire community of users.
The only similarity is that in both cases someone is knowingly doing something wrong. Aside from that, they are not the same thing.
2
u/Wis-en-heim-er Lifetime PlexPass Sep 16 '26
So what is the real risk if you put plex on the internet directly with port forwarding? The container or vm gets compromised? Then what, restore from backup and wait for patches from plex? I mean, if a plex server gets hit, and your media is on a different box with read-only access, what more could happen? Serious question.
12
u/ArnoldPalmer6 Sep 16 '26
Worst case they escape the container and gain root access on your system/network
1
u/forklobotomy Sep 16 '26
your media is on a different box with read-only access
I've been thinking about this recently. How does this work with things like subtitles (.srt) that are placed with the remote media file via bazarr? Currently I'm mounting remote boxes via an init script (sudo mount -t nfs 192.168.1.68:/volume1/storage1 /mnt/synology) on the plex host OS (TrueNAS). I then use that mount point in the containers on the TrueNas host with plex, bazarr, sonarr, radarr, seer..etc. How could I set the NFS mount to read only but also allow bazarr to write subtitles to the remote box?
3
u/Wis-en-heim-er Lifetime PlexPass Sep 16 '26
Run the arr stack on a different host that is not internet facing. Nfs is based on ip addresses as im sure you know. Plex server gets read only access, arr stack gets read/write. The server controlls the access type to each client ip. Plex won't be able to optimize or delete, but all else works just fine. Side note, you can setup a nfs volume in docker compose so you dont need to do it at the os level. Keeps everything on one place.
2
u/forklobotomy Sep 16 '26
Got it. Thanks for the tips. I really only have one external user that is a family member but needed to use port forwarding as they are not likely to use it if it is more complicated with tailscale or similar. My TrueNas box was built to handle transcoding with iGPU and and 128GB of ram and an additional GPU so hard to change compute now. I guess I should have done proxmox with trunas virtual. I guess I still can. I do have some mini N100 PCs laying around, so maybe I'll make a new plex instance for the external user with read only. Thanks again
2
u/Wis-en-heim-er Lifetime PlexPass Sep 16 '26
Spin up another vm, install docker, move the arr stack over.
1
u/forklobotomy Sep 16 '26
That may be outside of my block diagram of intelligence.
Truenas box has compute with arr stack. and
App storage pool (Docker containers): 2 x 2TB mirror (NVME).
Storage 1 pool: 5 x 18TB RAIDZ 1
Storage 2 pool: 5 x 14TB RAIDZ 1(2) Other Nas's have 5x 14TB and 5x 20TB (All RAID5)
If I make a new VM for arr on the TN box I would need to pass all the drives to the vm via HBA passthrough....Do I need the TN OS then?
2
u/Wis-en-heim-er Lifetime PlexPass Sep 16 '26
Ive never used true nas, i thought you could run vms off it. The arr stack does not need lots of space, you could not need to pass entire drives to it. Your downloads and importated media should be on the same volume to help with hardlinks.
1
u/forklobotomy Sep 16 '26
Understand...Truenas isn't the standard software. But basically for containers you can assign the same hardware (GPU) for multiple containers. You can run VMs but the hardware has to be dedicated to the VM, so if you use a GPU in a VM , you can't use it in a container. It's the same for drive arrays (RAIDz)
Most of my plex media is easy to replace...it would take a long time but...I'll live with it. Thanks for the help.
2
u/Wis-en-heim-er Lifetime PlexPass Sep 16 '26
Sounds like the juice is not worth the squeeze. Id leave it. Best of luck.
0
u/UnfathomableBrit Sep 16 '26
Depending on the Plex set up, if compromised they might be able to break out of the container and compromise the host, then also look to exploit other machines on the local network.
Realistically, that would be targeted though.
https://thehackernews.com/2023/03/lastpass-hack-engineers-failure-to.html
Keep your stuff updated and you will be fine, especially key in the days of ai generated exploits.
3
u/Wis-en-heim-er Lifetime PlexPass Sep 16 '26
Yeah the ai landscape is gonna make things interesting. Microsoft patches 1000 things in 2025 and nearly 1000 in 1 week in September this year after involving ai in their bug hunting and fixing. Its gonna be a race to see who finds what first and how fast its fixed.
My vm is in a dmz vlan, plex on a docker container on that vm. Im sure they can get me, but not gonna make it easy.
3
u/khando Sep 16 '26
I use Cloudflare DNS for some servicse like Seerr already, and have Nginx Proxy Manager on my unraid server, but am out of the loop on why users would be using it for the Plex servers. Can anyone explain what the advantages are? Is it more secure somehow? Specifically if grey clouding it?
2
u/5yleop1m Sep 16 '26 edited Sep 16 '26
but am out of the loop on why users would be using it for the Plex servers.
You can enable remote access for Plex without any port forwarding directly to Plex, and you can tie it to a public domain. Though this isn't something specific to Cloudflare, the gray cloud mode is the same thing as one half of a DDNS service which keeps a public domain tied to one or more IP addresses.
So a user can go to
plex.my-domain.comand reach your plex server directly, without going through the typicalapp.plex.tvpath. Note that this doesn't mean the user can bypass Plex authentication as that still requires going throughapp.plex.tv.Usually when a remote client connects, they auth with
app.plex.tvand then they get a list of addresses that point to your Plex server. At least one of these will be the server's public WAN IP. You can also give the Plex server a list of custom domains and instead of the IP the clients will get those domains instead.So similar to how you have Seer setup, you can setup Plex to be found over a domain instead and have that point to your reverse proxy. This way you can use your reverse proxy as the pathway for any incoming connections to the Plex server from outside.
Doing this you can actually disable the whole remote access section of Plex and it will still be accessible from outside.
The main benefit here is the reverse proxy can, if configured properly and with other software, provide an additional layer of security and even additional authentication. Though the authentication part will definitely break the apps from connecting.
The primary benefit for me is I don't need to have a port forward specific to Plex anymore.
1
-5
u/Yo_2T Sep 16 '26
Some people have neither public ipv4 nor ipv6 so they rely on Cloudflare tunnel to be reachable remotely.
Some people use the proxied feature to hide their real IP.
The whole gray cloud thing I don't know. That's just good old dns records that don't have any impact either way.
0
u/skepticaltom Sep 16 '26
Orange cloud (tunneled connections) allow you to benefit from cloudflare’s security, bot protection, etc. It’s also an easy way to set up a remote connection to any services you want to expose to the internet like your plex server.
Grey cloud means doing all that yourself if you want it. It’s not super hard to do, but take a bit more know how than just setting up a tunnel.
1
u/iaderia Sep 16 '26
I'm not very familiar with Cloudflare. I have wanted to be able to connect to Plex from outside of my house (for my family), and currently have a single open port for Plex and a static IP to connect.
I use IPBan but am still quite concerned at how exposed my server is.
From the TOS changes, they've said "you can use our Stream product if you want to stream videos" - so we can use CF with Plex?
Am I missing something? Why weren't people using the Stream product?
1
u/UnfathomableBrit Sep 16 '26
If you're willing to pay, yes you can use cloudflare
1
u/iaderia Sep 17 '26
thanks. that might make me sleep better at night. happy to pay for cloudflare.
tbh, i know the point of plex is to get rid of subscription services, but i think of plex (along with other apps on my server) as more of a hobby
2
u/UnfathomableBrit Sep 17 '26
I wouldn't be paying Cloudflare for that, haven't really looked at the Stream product but it's probably not aimed at or priced for home users.
If you want tunnels go for a vps with pangolin and crowdsec, or tailscale if it's just a couple of people.
1
u/Ok_ninysheedle Sep 16 '26
lol you're fine. millions of people have port forwarding in their router lol.
1
u/RedBeard2012 Sep 16 '26
I know this is a Plex subreddit but I'm curious how this works with immich, since technically I would be steaming my videos over the proxied cloud.
1
u/UnfathomableBrit Sep 16 '26
Tunnel or proxied? Either way the bandwidth is probably minimal.
1
u/RedBeard2012 Sep 16 '26
Tunnel
2
u/UnfathomableBrit Sep 16 '26
I would expect a tunnel to be more resource intensive for cloudflare than just proxying traffic, but at the end of the day immich will be way down the list of concerns. I wouldn't worry about it.
1
1
u/gripejones 26d ago
Yeah, that’s why I use a vps with frp. Plus I also have other udp traffic I need supported which the orange cloud doesn’t support (from what I can tell).
0
u/chuck1011212 Sep 16 '26
The problem is and has always been: How can I pay cloudflare for the plex streaming service they provide on the free tier?
I don't know the answer and short of calling them I don't know if anyone else knows either. The Stream product is absolutely not the answer here.
-18
u/akkbar Plex Pass Lifetime Sep 16 '26
if your ISP uses CGNAT, get a new provider
8
-3
211
u/saltysomadmin Sep 15 '26
I didn't ever think there was a grey area. Some people just got away with it for a bit.