The main objective of this guide is to configure NordVPN, your router, and your Windows firewall to create a bypass for incoming connections and to be able to offer connections to your server from your router using port forwarding

If we do it correctly, we’ll be able to have services such as JellyFin with IPTV that can be accessed securely, Immich, Plex, or other services.

We’re going to assume that we’ve already installed JellyFin and Caddy, and configured the router by doing port forwarding to our server. See our guide to achieve a complete and secure installation of JellyFin.

We’re going to expose Jellyfin with Caddy on Windows 10 using the router’s port forwarding while NordVPN is active, integrating what you and I already tested + the key point from the thread you shared (the “Allow remote access…” toggle).

Basic idea: we’re not doing port forwarding “through NordVPN” (Nord doesn’t support it). Instead, you publish your server on your real public IP (router → your PC) and, at the same time, keep NordVPN for the rest of the traffic. For incoming connections to keep arriving even while the VPN is connected, you need to:

1. Enable Allow remote access while connected to VPN in the Nord app,

2. Exclude Caddy from the tunnel (split tunnelling),

3. Force Caddy to listen only on your physical interface (bind),

4. A couple of firewall rules and interface metrics so that Windows doesn’t divert anything through Nord’s adapter.
   

0) Prerequisites (quick checklist)

• Router with port forwarding 80→PC:80 and 443→PC:443.

• Domain/DDNS pointing to your public IP (e.g. sampledomain.ddns.net).

• Jellyfin installed and working on local HTTP (e.g. 127.0.0.1:8096).

• Caddy installed on Windows (Chocolatey or standalone binary).

• NordVPN for Windows 10.

• Important about Let’s Encrypt: if you use HTTP-01 you need port 80 to be accessible from the Internet; if you block 80, you can use TLS-ALPN-01 on 443. Official recommendation: leave 80 open and redirect to 443. Let's Encrypt+1

• About NordVPN and port forwarding: Nord does not support port forwarding through its servers; that’s why you publish via your real IP and not through Nord. For remote access, Nord pushes Meshnet as an alternative. (We’re going down the router + app settings route). NordVPN+1

1) Configure NordVPN to allow incoming connections while the VPN is active

1. Open the NordVPN app → cog (Settings).

2. In Connection & security / Connection, enable “Allow remote access while connected to VPN” (Allow remote access while connected to VPN).

   • This option appears documented in the official guide (in Portuguese it shows the exact text: “Permitir acesso remoto ao se conectar à VPN… Desativado por padrão”). Turn it on. NordVPN Support

3. Practical tip (what you saw in the thread): if it has no effect, turn that toggle off and on again and reconnect the VPN. Several third-party articles document this setting for RDP/incoming connections when the VPN is active. help.bitlaunch.io+1

Note: If you’d rather never open ports, Meshnet gives you remote access without exposing 443/80, but here we’re continuing with classic port forwarding. NordVPN+1

2) Force the Nord protocol that does respect the bypass

On Windows, NordLynx (WireGuard) can “capture” inbound connections to 80/443 at kernel level; with OpenVPN (UDP) the bypass works because it uses TAP and respects bind, firewall and metrics. Switch to OpenVPN UDP:

:: 1. Disable NordLynx (WireGuard)
nordvpn set technology openvpn

:: 2. Choose UDP protocol
nordvpn set protocol udp

:: 3. Disable auto-connect (prevents switching back to NordLynx)
nordvpn set autoconnect off

:: 4. Disconnect
nordvpn -d

:: 5. Connect with OpenVPN UDP
nordvpn -c

Then raise the metric of Nord’s TAP and lower that of your physical NIC (e.g. “Ethernet 6”):

netsh interface ipv4 set interface "Ethernet 6" metric=1
netsh interface ipv4 set interface "TAP-NordVPN Windows Adapter" metric=300

Check names with:

netsh interface ipv4 show interfaces

If you use NordLynx, the bypass may not work even if you tweak metrics. Switching to OpenVPN (UDP) was an important detail to get it working correctly. I disabled the NordLynx driver.

3) ESSENTIAL in NordVPN (Windows)

Enable the permission for remote access while the VPN is connected

1. Open NordVPN → cog icon (Settings).

2. Go to Options → Connection & security.

3. Enable “Allow remote access while connected to VPN”

   Help text in the app: “Access this computer remotely, for example, via remote desktop applications”.

Trick that makes it kick in (what worked for you):

• Turn that switch off, turn it back on, disconnect the VPN and reconnect it. Sometimes the app “forgets” to apply that policy and the toggle reset forces it to take effect.

Immediate test (with Nord connected):

• Make sure the router forwards 443→PC:443 (and 80→80 if you use HTTP-01).

• From another network/4G (or forcing public IP):

Immediate test (with Nord connected):

• Make sure the router forwards 443→PC:443 (and 80→80 if you use HTTP-01).

• From another network/4G (or forcing public IP):

  curl -vk https://YOUR_DOMAIN --resolve YOUR_DOMAIN:443:YOUR_PUBLIC_IP
  

  If you see the TLS handshake and a response from Caddy/Jellyfin, remote access is allowed and working and you don’t need to do any more steps.

4) Exclude Caddy from the tunnel (Split tunnelling)

• In the NordVPN app → Split tunnelling → Exclude/Disable VPN for selected apps → add caddy.exe (path to your installation). NordVPN

This makes outbound traffic from Caddy (for example, ACME validations) not go through the VPN. It’s the first pillar of the bypass.

5) Firewall rules to isolate Caddy from Nord’s adapter

5.1 OUTBOUND block (prevents caddy.exe from going out via the tunnel’s private networks: 10/8 and 172.16/12):

New-NetFirewallRule -DisplayName "BLOCK Caddy → NordVPN (10.0.0.0/8 + 172.16.0.0/12)" `
  -Direction Outbound -Action Block `
  -Program "C:\ProgramData\chocolatey\lib\caddy\tools\caddy.exe" `
  -RemoteAddress 10.0.0.0/8,172.16.0.0/12 `
  -Profile Any -Enabled True

5.2 INBOUND block (prevents incoming connections to 80/443 from “landing” on the IP of the Nord adapter):

New-NetFirewallRule -DisplayName "BLOCK Caddy IN on NordVPN (10.0.0.0/8)" `
  -Direction Inbound -Action Block `
  -LocalPort 80,443 -Protocol TCP `
  -LocalAddress 10.0.0.0/8 `
  -Profile Any -Enabled True

These two rules are the ones you verified as OK.

6) Set route metrics and LAN route so Windows doesn’t prefer the tunnel

• Lower the metric of your physical NIC (1–10) and raise that of Nord’s TAP (300).

• Static LAN route so that all 192.168.1.0/24 goes via your real gateway:

route delete 192.168.1.0
route add 192.168.1.0 mask 255.255.255.0 192.168.1.1 metric 1 -p

With this, the routing table is consistent: by default it goes out via your real gateway, Nord’s TAP is “expensive” (high metric) and the LAN always uses the router.

7) Caddy: bind to your physical IP + reverse proxy to Jellyfin

Caddyfile (example):

{
  email [email protected]
  storage file_system {
    root C:\ProgramData\chocolatey\lib\caddy\tools\data
  }
}

sampledomain.ddns.net {
bind 192.168.1.50        # <-- your static LAN IP
encode zstd gzip
@http    { protocol http }
redir @http https://{host}{uri} 308

reverse_proxy 127.0.0.1:8096
} 

{
    email [email protected]
    storage file_system {
        root C:\ProgramData\chocolatey\lib\caddy\tools\data
    }
}

sampledomain.ddns.net {
tls {
issuer acme {
disable_http_challenge
}
}
bind 192.168.1.50
reverse_proxy 127.0.0.1:8096
} 

• The bind forces Caddy to listen only on your physical interface, not on the VPN adapter. Caddy Web Server

• Automatic HTTPS: Caddy requests/renews the certificates. For HTTP-01, 80 must be open (recommended by Let’s Encrypt). Alternatively, TLS-ALPN-01 validates over 443 if you can’t open 80. Caddy Web Server+2Let's Encrypt+2
  

If validation returns “Timeout during connect (likely firewall problem)”, check that 80/443 on the router are open towards your PC and that Nord’s toggle from step 1 is active. That error is typical of port 80 blocked in HTTP-01. docs.flashpanel.io

8) Port forwarding on the router

• WAN 80 → 192.168.1.50:80

• WAN 443 → 192.168.1.50:443
  Verify with mobile data (avoid hairpin NAT) and with:

curl -vk https://sampledomain.ddns.net/ --resolve sampledomain.ddns.net:443:YOUR_PUBLIC_IP

9) (Optional) Run Caddy as a service and have the split apply to it

If you use NSSM:

nssm install Caddy "C:\ProgramData\chocolatey\lib\caddy\tools\caddy.exe" run --config Caddyfile
nssm set Caddy AppDirectory "C:\ProgramData\chocolatey\lib\caddy\tools"
nssm set Caddy AppStdout "C:\ProgramData\caddy\logs\caddy.out.log"
nssm set Caddy AppStderr "C:\ProgramData\caddy\logs\caddy.err.log"

Tip: run the service under your user (not LocalSystem) so that Nord’s Split tunnelling also applies to the service.

10) Quick tests (with NordVPN connected)

1. Listening

netstat -ano | findstr :80
netstat -ano | findstr :443

You should see 192.168.1.50:80 and :443 (not 0.0.0.0, not 10.x.x.x).

If you only do it on 443, check only that one. If more than one service appears, you’ll see the PID; you may have Apache or similar.

2. Local

curl http://192.168.1.50:8096  (Jellyfin)
curl -k https://192.168.1.50   (Caddy -> Jellyfin, internal cert if you set it)

3. From outside (4G or another network)

curl -vk https://sampledomain.ddns.net/

4. Public IP for general traffic (it should be Nord’s)

curl ifconfig.me

11) Troubleshooting (the most common things that “break”)

• It doesn’t accept connections from outside when Nord is active

  • Confirm step 1 (Allow remote access…) and toggle it OFF/ON again if it “forgets” to apply (several users resolve it this way). help.bitlaunch.io+1

  • Make sure you’re on OpenVPN (UDP), not NordLynx.

  • Check the firewall rules OUT/IN (step 4).

  • Verify metrics and LAN route (step 5).

• Caddy can’t obtain the certificate

  • Open 80 (recommended by Let’s Encrypt) or use TLS-ALPN on 443, but the validator must reach your host. Let's Encrypt+1

• With NordLynx (WireGuard) it still doesn’t work even if I change metrics

  • Switch to OpenVPN (UDP): it’s the switch that worked consistently for you.

• General connection drops due to Kill Switch

  • Disable Internet Kill Switch / App Kill Switch while testing. (The Kill Switch can block non-tunnelled inbound/outbound traffic).

12) (Advanced optional) Ensure ACME outbound traffic doesn’t go through the VPN

If you still see ACME going through the tunnel, add static routes to ranges used by Let’s Encrypt so they go via your real gateway:

route add 172.65.32.0 mask 255.255.255.0 192.168.1.1 -p
route add 104.18.14.0 mask 255.255.254.0 192.168.1.1 -p

13) (Advanced optional) Batch file to change VPN metrics

If necessary (between machine restarts) you can create this batch file to reconfigure everything. Remember that in the example the interface is Ethernet 6; in your case it may be a different one.

@echo off
echo.
echo  STARTING EVERYTHING: NORDVPN + CADDY (BYPASS)
echo.

:: 1. Disconnect NordVPN
echo Disconnecting NordVPN...
nordvpn -d

:: 2. Kill Caddy
echo Killing Caddy...
taskkill /f /im caddy.exe >nul 2>&1

:: 3. Connect NordVPN
echo Connecting NordVPN...
nordvpn -c

:: 4. Wait and force metrics
echo Waiting 5 seconds...
timeout /t 5 >nul
netsh interface ipv4 set interface "Ethernet 6" metric=1
netsh interface ipv4 set interface "NordLynx" metric=300

:: 5. Start Caddy
echo Starting Caddy...
cd /d "C:\ProgramData\chocolatey\lib\caddy\tools"
caddy run

pause

Visual summary of the recipe

• NordVPN:

  • ✅ Allow remote access while connected to VPN → ON (and if it fails, toggle OFF/ON). NordVPN Support+1

  • ✅ OpenVPN (UDP) (not NordLynx).

  • ✅ Split tunnelling (exclude caddy.exe). NordVPN

• Windows:

  • ✅ Firewall OUT: block caddy.exe to 10.0.0.0/8, 172.16.0.0/12.

  • ✅ Firewall IN: block 80/443 on LocalAddress 10.0.0.0/8.

  • ✅ Metrics: physical NIC 1; Nord’s TAP 300; LAN route 192.168.1.0/24 via your gateway.

• Caddy:

  • ✅ bind 192.168.1.x + reverse proxy to 127.0.0.1:8096. Caddy Web Server

  • ✅ Automatic HTTPS (80 open recommended; or TLS-ALPN-01 on 443). Caddy Web Server+2Let's Encrypt+2

Final notes

• Nord does not support port forwarding “through the VPN”, which is why this guide uses your public IP + adjustments so that Nord doesn’t interfere. If you don’t want to open 443/80, consider Meshnet (secure remote access with no ports). NordVPN+1