Access Immich Safely from Outside Your Home with a VPN or Tunnel
At home, Immich just works. From a hotel in another city, it does not — and the obvious fix, forwarding one port on your router, is the one move you must not make. Here are the routes that give you your photos from anywhere without handing the internet a door to try.
✍️ Technical Anshu🐳 Docker / Linux Server⏱️ 7 minute read
🎥 The video builds the server — this guide opens it to the world without opening it to attackers
Every home server faces the same question: how do I reach it from outside? Immich listens on port 2283, and routers happily forward ports — so the temptation is real. Resist it. A self-hosted app on a home server is maintained by you, updated by you, and patched on your schedule. The open internet does not care about your schedule: automated scanners probe exposed services continuously, and any week you are late with an update is a week an open door stands tested. There are better doors.
Three ways to reach Immich from outside — graded honestly
VPN into home network (WireGuard / Tailscale class)SAFEST
Tunnel with access control (Cloudflare Tunnel class)GOOD
Reverse proxy with HTTPS and strong passwordsCAREFUL
Port 2283 forwarded straight to the internetNEVER
👆 Example grading panel. The bottom row is how photo servers get found by scanners within hours of going online.
1
Option One — a VPN into Your Home Network (the Safest Default)
With a VPN, your phone joins your home network from anywhere, and Immich never faces the internet at all:
WireGuard on your router, NAS or the server itself — fast, free, and the classic choice. Your phone connects, then opens Immich at the same home address as always
Tailscale-class mesh VPNs — the easy version of the same idea: install it on the server and the phone, sign in, and they find each other securely with almost no configuration
The app keeps using the same server address — no second configuration, no public URL, nothing for a scanner to find
The honest cost: one extra tap to connect the VPN before opening Immich. For a family photo archive, that tap is cheap insurance
2
Option Two — a Tunnel with an Access Gate
Tunnel services (Cloudflare Tunnel is the best-known) make an outbound connection from your server to the provider, so no router port is opened at all, yet you get a normal-looking web address for Immich:
Nothing inbound is exposed — the tunnel is dialled outwards from your server
Add the provider's access controls in front of it: only your family's email addresses get past the gate, everyone else sees a login wall before Immich even loads
HTTPS is handled for you, so the address works in the app exactly like a website
The honest costs: your traffic passes through a third party's network, and free tiers come with the provider's terms and limits. For most families this trade is reasonable — but make it knowingly
3
Option Three — a Reverse Proxy, Only with Your Eyes Open
Experienced self-hosters often put a reverse proxy (Nginx Proxy Manager, Caddy, Traefik class) in front of Immich with a proper HTTPS certificate. This is legitimate — and it is the option with the most ways to get it wrong:
The proxy and Immich both become internet-facing software that you must keep updated, promptly, forever
Strong, unique passwords and any available two-factor settings stop being optional
If you cannot honestly commit to monthly updates, choose the VPN or the tunnel instead. There is no shame in it — they exist precisely for this
4
Whichever Route You Choose — Finish the Job
Test from mobile data with Wi-Fi off — the only honest test of 'outside'
Enter the new address in the Immich app's server settings and confirm photos load and a test upload completes
Give every family member their own account — shared logins make revocation impossible when a phone is lost
If a phone is lost, change that account's password from the web interface the same day
Write down which route you chose and how to switch it off. The fastest incident response is a route you can close in one minute
🔴 Never forward port 2283 directly to the internet. Not "temporarily", not "just to test". Scanners do not take days off, and a home photo server holds the most personal data a family owns. VPN first, tunnel second, proxy with discipline third — exposed port never.
🎥 Watch the Complete Process in the Video
Watch the install video to get the server running — then pick your remote route here before sharing the address with anyone.
Why is forwarding one port so dangerous if Immich has a login page?
Because the login page is not the only thing exposed — the whole application is, including any security flaw discovered before you install the fix. Public services are probed by automated scanners within hours. A VPN or tunnel keeps Immich invisible to everyone except your own devices.
My family finds the VPN step annoying. Is the tunnel really okay?
Yes, with the access gate switched on. A tunnel with the provider's login wall in front — restricted to your family's email addresses — is a respectable, widely used setup. The combination to avoid is a public address with nothing in front of Immich's own login.
Can I use Immich's own sharing links with remote access?
Yes. Once your remote route works, sharing links work through it like any other page. Share specific albums rather than handing out accounts, and remember a public link is visible to anyone who receives it — treat links like keys.
This guide is based on the Technical Anshu video linked above • Stuck on a step? Ask in the video comments — that is where answers come fastest 🙏