Plex

Industry-leading media server for every platform

Plex is a client-server media player system that allows you to stream your media content to any Plex-enabled device. With apps for every major platform—smart TVs, mobile devices, streaming boxes, and web browsers—Plex provides a beautiful, intuitive interface for accessing your personal media library from anywhere. QuickBox Pro installs Plex from the official Plex repository with per-user data directories, hardware acceleration support, and optional automatic server claiming.

Installation

Basic Installation

Install Plex for a specific user:

qb install plex -u username

Installation with Plex Claim Token

For automatic server claiming (recommended for easy setup):

1. Get your Plex Claim Token from https://www.plex.tv/claim/ 
2. Install with the token (valid for 4 minutes):

qb install plex -u username -pct 'claim-xxxxxxxxxxxxxxxxxxxx'

Installation Commands

VPN routing and Plex account registration

When Plex starts for the first time, it makes an initial connection to plex.tv to register the server. Plex.tv records the outbound IP address it sees during this initial connection and associates it with your account for remote access.

Accessing Plex during initial setup (HTTPS certificate window)

When Plex is routed through the VPN, it requests its TLS certificate from plex.tv through the VPN exit IP. VPN providers can briefly rate-limit new certificate requests, so the certificate may take a few minutes to provision after install or after VPN routing is first enabled.

During that provisioning window, opening Plex over https:// fails with a browser error similar to:

app.plex.tv is unable to connect to your server securely. Its Secure connections setting may be set to disabled.

This is expected and temporary. While the certificate is still being issued, access Plex directly over plain HTTP:

http://<your-server-IP>:32400/web/

Plain HTTP has no TLS-certificate dependency — the setup wizard loads and completes normally. The QuickBox dashboard’s Plex link uses this HTTP URL automatically while the certificate is pending, so clicking Launch from the dashboard works without any manual steps.

Once Plex finishes provisioning its certificate (usually within a few minutes, automatic — no user action required), normal https:// access works and the dashboard link switches back to the standard URL.

Stage routing before installing Plex

QuickBox Pro supports staging VPN routing for Plex before the application is installed. Staging pre-configures the VPN tunnel so that Plex’s initial connection to plex.tv goes through the VPN from the very first moment it starts — even during the install itself.

How to stage routing:

1. Go to Dashboard → System → VPN Control
2. Upload at least one WireGuard .conf file if you have not done so already
3. Scroll to the App-Scoped Routing card — Plex will appear in the list even though it is not yet installed
4. Select Plex from the app list
5. Choose a WireGuard peer configuration from the dropdown
6. Click Stage Routing

Once staged, the dashboard shows a Staged · awaiting install indicator (sky-blue badge with a clock icon) on the Plex routing row. This means the VPN tunnel configuration is ready and waiting. No kill switch or live metrics are shown at this stage — those become active after install.

7. Install or reinstall Plex from Package Management (or via CLI)

After Plex installs successfully, the routing profile automatically finalizes — the badge transitions from Staged · awaiting install to Active (green). Plex’s initial connection to plex.tv will have gone through the VPN tunnel.

If Plex is already installed

If Plex is already running and you want to enable VPN routing:

1. Go to System → VPN Control → App-Scoped Routing
2. Select Plex, choose a WireGuard config, and click Enable Routing
3. Plex will restart inside the VPN tunnel

The next time Plex connects to plex.tv it will present the VPN exit IP. To update your account’s registered address, unclaim and re-claim the server via Settings → General → Claim Server in the Plex web interface, or reinstall with a fresh claim token:

qb reinstall plex -u username -pct 'claim-xxxxxxxxxxxxxxxxxxxx'

Reinstalling with routing already active

If VPN routing is already active for Plex and you run a reinstall, the tunnel stays up during the reinstall process. Plex runs inside the VPN tunnel throughout — no re-claim is needed after a reinstall when routing was already enabled.

For full details on VPN routing configuration, kill switch settings, and live metrics, see the VPN Control dashboard page.

Remote access through VPN

When you enable VPN app-routing for Plex, QuickBox Pro wires things up so that both sides of the connection work correctly at the same time:

When Plex routes through the VPN, QuickBox keeps the inbound port (32400) reachable directly on your seedbox’s public IP while Plex’s outbound calls — library scans, plex.tv API, account registration — travel through the VPN tunnel. Plex automatically publishes the correct connection address to plex.tv so cloud clients connect securely without needing Plex Relay.

What the user does: Go to Dashboard → System → VPN Control, select Plex in the App-Scoped Routing card, choose a WireGuard peer, and click Enable Routing (or Stage Routing before install). That is the entire setup. No manual port forwarding, no Preferences.xml editing, no Plex Relay toggle.

What you will see after enabling VPN routing for Plex:

• In your plex.tv account, go to Settings → Manage → Your servers
• Your server appears as Reachable and Secure connections is checked
• No “publishing port 0” warning, no Relay notice
• Plex clients connect at full bandwidth

Compatible VPN providers: VPN app-routing for Plex works with any WireGuard .conf file — NordVPN, Mullvad, PIA, ProtonVPN, IVPN, and self-hosted WireGuard peers. NordVPN has been tested end-to-end at full bandwidth.

”You are not connected directly” — first-load browser modal

The first time you open plex.tv in a new browser session after enabling VPN routing, Plex may show a one-time dismissable modal: “You are not connected directly to your server. For the best experience, we recommend a direct connection.”

This is expected behavior — not an error. Here is why it appears:

When VPN routing is active, Plex registers your server on plex.tv with the VPN exit IP as its public address (that is the privacy benefit of routing through the VPN). The direct-connect URL that Plex publishes for secure client connections points to your server’s real seedbox IP. plex.tv notices that those two addresses do not match and shows the modal as a heads-up on the first load of that browser session.

The actual connection is unaffected. Clients connect at full bandwidth via the direct-connect URL. The modal does not mean Plex is falling back to Relay — if your plex.tv account shows the server as Reachable with Secure connections checked, everything is working correctly.

What to do: Dismiss the modal. It will not appear again in the same browser session.

Per-app “Direct remote access” toggle

On the VPN App Routing card in Dashboard → System → VPN Control, each application row has a Direct remote access toggle:

• Plex — defaults on. When on, QuickBox sets up the inbound connection plumbing so that Plex clients can reach your server directly on port 32400 at full bandwidth, bypassing the VPN for the inbound path. Plex’s outbound calls (library scans, plex.tv API, account activity) continue through the VPN tunnel.
• Download clients (qBittorrent, etc.) — defaults off. Inbound peer connections for downloaders travel through the VPN peer port, so the inbound bypass is not needed.

You can toggle this setting at any time from the routing card. If you disable it for Plex, inbound client connections will no longer have the direct-connect path — remote access falls back to Plex Relay or an external VPN tunnel on the client side. Re-enabling it restores the direct-connect setup automatically.

Directory Structure

Configuration Details

System-wide installation:

• Service: plexmediaserver.service
• Default port: 32400 (shared across all users)
• SSL port: 32443 (when configured with -d domain)

Per-user data directories:

• Config directory:

/home/username/.config/Plex Media Server/

• Database:

/home/username/.config/Plex Media Server/Plug-in Support/Databases/com.plexapp.plugins.library.db

• Logs:

/home/username/.config/Plex Media Server/Logs/

• Preferences:

/home/username/.config/Plex Media Server/Preferences.xml

Custom data directory (with -D flag):

• QuickBox creates a symbolic link from /home/username/.config/Plex Media Server to your custom path
• Permissions are automatically configured for the plex user

Accessing Plex

After installation, Plex is accessible through multiple methods:

First-Time Setup:

1. Sign in with your Plex account (or create one at plex.tv)
2. If you didn’t use a claim token during install, manually claim your server
3. Set up your media libraries (Movies, TV Shows, Music, Photos)
4. Configure remote access settings

Permissions & Group Membership

How QuickBox Configures Permissions

QuickBox automatically executes these group assignments during install/reinstall/update:

# Allow plex to access user media files
usermod -a -G username plex
 
# Allow user to manage plex configuration
usermod -a -G plex username
 
# Enable hardware transcoding (GPU access)
usermod -a -G render username
usermod -a -G video username
 
# Enable web access through nginx
usermod -a -G www-data plex
usermod -a -G plex www-data

Manual Group Management (Troubleshooting Only)

If you need to manually verify or fix group membership:

# Add user to plex group
sudo usermod -aG plex username  # see above for other groups
 
# Verify group membership
groups username

File Permission Issues

Initial Configuration

1. Claim Your Server

If you didn’t use a Plex Claim Token during installation:

1. Open Plex web interface at http://your-ip:32400/web
2. Sign in with your Plex account
3. Click “Claim Server” in the top banner
4. Your server will be linked to your account

2. Add Media Libraries

Set up libraries for your media:

1. Click “Add Library” in the sidebar
2. Select library type:
   • Movies - Feature films and home videos
   • TV Shows - Television series and episodes
   • Music - Audio files and albums
   • Photos - Photo collections
3. Add folder paths:
   • /home/username/media/movies
   • /home/username/media/tv
   • /home/username/media/music
   • Or custom paths you’ve configured
4. Configure advanced settings:
   • Scanner: Plex Movie/TV Show Scanner (recommended)
   • Agent: Plex Movie/TV Series (for metadata)
   • Language: Preferred language for metadata
5. Click “Add Library”

3. Configure Remote Access

Enable streaming from anywhere:

1. Go to Settings → Remote Access
2. Click “Enable Remote Access”
3. Plex will attempt automatic port forwarding via UPnP
4. If UPnP fails, manually forward port 32400 on your router
5. Verify remote access shows “Fully accessible outside your network”

Service Management

Plex runs as a system-wide systemd service.

systemctl status plexmediaserver     # Check status
systemctl restart plexmediaserver    # Restart service
journalctl -u plexmediaserver -f     # View live logs
systemctl enable plexmediaserver     # Start on boot (already enabled)
systemctl disable plexmediaserver    # Prevent auto-start

Troubleshooting

Plex Won’t Start

journalctl -u plexmediaserver -f

Check data directory permissions:

ls -la /home/username/.config/Plex\ Media\ Server
# Should be owned by plex:plex
sudo chown -R plex:plex /home/username/.config/Plex\ Media\ Server

See Permissions & Group Membership section for details about user groups and additional permissions.

Can’t Claim Server

Remote Access Not Working

# Check if port 32400 is open
sudo netstat -tlnp | grep 32400
 
# Verify nginx reverse proxy (if using custom domain)
sudo nginx -t
sudo systemctl reload nginx
 
# Test external access
curl http://your-public-ip:32400/web

Hardware Transcoding Not Available

Hardware transcoding requires Plex Pass and compatible GPU:

# Check GPU availability (Intel Quick Sync, NVIDIA, AMD)
lspci | grep -i vga
 
# Verify user is in render and video groups
groups username
# Should show: render video plex
 
# Add groups if missing
sudo usermod -a -G render username
sudo usermod -a -G video username
sudo systemctl restart plexmediaserver

Library Not Scanning

# Manual library scan via Plex web interface
# Settings → Library → Scan Library Files
 
# Check file permissions
sudo chown -R username:username /home/username/media
 
# Verify Plex can access media directory
sudo -u plex ls -la /home/username/media

Configuration Reset

# Backup current configuration
cp -r /home/username/.config/Plex\ Media\ Server /home/username/.config/Plex\ Media\ Server.backup
 
# Stop service
sudo systemctl stop plexmediaserver
 
# Reset preferences (keeps libraries and metadata)
rm /home/username/.config/Plex\ Media\ Server/Preferences.xml
 
# Restart service
sudo systemctl start plexmediaserver

Best Practices

Use Cases

Personal Media Server

• Stream your personal movie, TV, music, and photo library to any device
• Beautiful interface with automatic artwork and metadata
• Universal apps for all platforms (iOS, Android, smart TVs, Roku, Apple TV, etc.)

Multi-User Family Server

• Create managed accounts for family members with parental controls
• Separate watch history and recommendations per user
• Share libraries while controlling access to specific content

Remote Streaming

• Access your media from anywhere with remote access
• Automatic transcoding for smooth playback on any device
• Full-bandwidth direct connect even when Plex is routed through a VPN

WSDashboard Integration

WSDashboard — the built-in QuickBox Pro v4 streaming dashboard — supports Plex alongside Emby and Jellyfin. You can monitor live Plex sessions, control playback, browse your Plex media library, and track watch analytics directly from the QuickBox Pro dashboard without switching to the Plex web interface.

Automatic configuration on install

When you install Plex using the -pct claim token flag, the v3 CLI automatically populates the WSDashboard connection settings for you:

qb install plex -u username -pct 'claim-xxxxxxxxxxxxxxxxxxxx'

After install completes, WSDashboard will be pre-configured with:

• Server URL — automatically detected (uses http://10.200.2.2:32400 if Plex is running in a VPN network namespace, or http://127.0.0.1:32400 otherwise)
• X-Plex-Token — extracted from Preferences.xml and written to the dashboard settings automatically

If you installed Plex without a claim token, the WSDashboard Settings page will show a setup banner prompting you to enter your token manually.

Manual token setup

If you need to enter or update your Plex token manually:

1. Go to Dashboard → Streaming → Settings
2. Scroll to the Plex server card under Connection Settings
3. Paste your X-Plex-Token into the X-Plex-Token field
4. Enter your Plex server URL (typically http://127.0.0.1:32400)
5. Click Test to verify the connection, then Save

To retrieve your token: sign in to plex.tv , go to Account → Authorized Devices, select your server, and copy the token from the URL bar or device settings.

What WSDashboard shows for Plex

WSDashboard displays Plex sessions with the same real-time detail it provides for Emby and Jellyfin — who is watching, what they are watching, playback quality, bandwidth, and device information. Sessions are tagged with an amber Plex indicator so you can distinguish them at a glance when multiple servers are configured.

Managing Plex tuners

If you run Live TV in Plex, WSDashboard can list and manage your Plex tuner (grabber) devices from Dashboard → Streaming → Settings → Plex Tuners. Each tuner is classified as active (bound to a working DVR), staged (registered and reachable but not yet bound — typically a test tuner), or orphaned (registered but unreachable). You can give each tuner a local display name, see a live usage gauge (X / N streams in use), enable or disable it, and remove leftover or test tuners — which is handy when an old Dispatcharr HDHomeRun instance or an abandoned test leaves stale tuners behind in Plex.

A tuner’s number (for example 4) is its concurrent-stream capacity — the number of simultaneous streams that one tuner can serve, not a count of separate devices. Display names are a QuickBox-side label only; Plex has no rename API, so they are never pushed back to Plex.

For the full walkthrough, see WSDashboard Settings → Plex Tuners.

Plex-specific capability notes

Plex has a different feature model from Emby and Jellyfin. WSDashboard handles these differences gracefully:

For full WSDashboard documentation, see the Streaming Dashboard page.

Related Applications

Live TV, tuners, and HDHomeRun

If you want Live TV inside Plex without a physical capture card, the supported QuickBox path is Dispatcharr — a self-hosted IPTV proxy that emulates an HDHomeRun tuner and an XMLTV guide. QuickBox installs Dispatcharr per user and configures everything Plex needs (including the AC3 audio profile that lets Plex tune the channels) so you can point Plex’s Live TV & DVR at it directly.

You connect Plex to Dispatcharr’s emulated HDHomeRun tuner at its /hdhr URL — not to an XMLTV/guide file and not to a raw LAN-IP:port. When Plex runs on a different device (the usual case), use the nginx URL https://your-server/username/dispatcharr/hdhr (subpath) or https://dispatcharr.example.com/hdhr (subdomain). When Plex runs on the same QuickBox server as Dispatcharr, you may use http://127.0.0.1:<PORT>/hdhr, where <PORT> is the main port shown on the Dispatcharr row in the App Dashboard (not the Daemon port). Dispatcharr’s services bind loopback only, so a server-LAN-IP-plus-port tuner URL never works. See How to: connect Dispatcharr to Plex for the URL breakdown.

Additional Resources

FAQ