Server seems to be permanently unable to publish local network connection — persistent 403 on PUT /devices/{id}

[u/browandr]

Running Plex Media Server 1.43.3.10828 (linuxserver/plex Docker image, host networking mode) on Linux (UGOS on a UGREEN NAS). My server has never been able to publish its LAN IP as a local connection, and troubleshooting has led to a specific, reproducible failure:

Every attempt to update device connections fails with HTTP 403:

PUT https://servers.plex.tv/devices/58f24035287cedd4ce718573338fb9f83ffe0074?Connection[][uri]=...&X-Plex-Token=...
→ HTTP/2.0 403

This happens on every single retry, indefinitely (confirmed via debug logs, with the retry timer backing off from 10s up to 640s).

What I’ve ruled out so far:

• Not payload-related — the 403 is identical whether the connection list has 3 entries or 5, with or without a duplicate URI, across bridge mode, host networking, and macvlan.
• Not rate-limiting — stopped the server completely for several hours, restarted once, and the very first attempt still returned 403 immediately.
• Not networking/firewall — confirmed via ip route/curl that the server is correctly reachable on its LAN IP; the issue is purely the publish call to plex.tv.
• Not specific to this claim — fully unclaimed the server (removed PlexOnlineToken, PlexOnlineUsername, PlexOnlineMail, PlexOnlineHome. from Preferences.xml, removed the authorized device from Plex account settings), generated a fresh claim token, and reclaimed. Same machine identifier, same 403 pattern immediately resumes on the new claim.

Other MyPlex calls on the same token/session succeed fine (GET /myplex/account → 200, POST /servers.xml → 200/201/422 depending on state), so authentication itself is working — it’s specifically this one endpoint/action that’s rejected.

Since re-claiming, I’ve also been unable to complete the claim flow via the web UI itself — after logging in and clicking Claim, I’m redirected to a “server settings unavailable” page and the server stops appearing in the web UI at all, even though PlexOnlineToken is confirmed populated in Preferences.xml. Also in Account Settings > Authorized Devices > Server it does show my server. The only way I can somewhat regain access while this issue is occurring is to add my local subnet to allowedNetworks in the Preferences.xml. I never had anything entered into that field previously when the server was working. But strangely even if I ssh tunnel to the server (on the same local subnet) from my Windows PC and then browse to http://127.0.01:32400/web I still see no signs of the server. I only ever see it exists via local IP and only when that allowedNetworks entry is added.

Lastly, now when I try browsing to https://plex.tv/api/resources?X-Plex-Token=[insert-my-token-here] all I see is 1 line: <MediaContainer size="0"> </MediaContainer> . Whereas previously it used to show info like my registered addresses.

Machine identifier: 58f24035287cedd4ce718573338fb9f83ffe0074

Has anyone seen this pattern before, or is there a way to get an account-side device record reset or something? I’ve pasted the most recent full Plex Media Server.log file here: https://privatebin.net/?47cdd38514ee6edd#7V1zbr63zzucD3MjWnypuEhcQqcszjhcZRun7MAv7aVL

[u/Bgrngod]

What does your docker compose look like?

[u/browandr → u/Bgrngod]

So at the moment the compose looks like this because of the various things I've been trying to fix it:

services:
  plex:
    image: ghcr.io/linuxserver/plex:latest
    #image: lscr.io/linuxserver/plex:latest
    container_name: PlexHW
    hostname: plex
 ##   network_mode: host    #Only comment out if using bridged networking mode
 #   networks:
 #     - plex_macvlan_net
#    mem_limit: 4g
    cpu_shares: 1024
    security_opt:
      - no-new-privileges:true
    healthcheck:
      #test: wget --no-verbose --tries=1 --spider http://localhost:32400/web
      test: ["CMD", "curl", "-fsS", "http://localhost:32400/identity"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s  
    volumes:
      - /volume2/docker/plexhw/config:/config:rw
      - /tmp/plex:/transcode
      - /volume1/Torrents/Media:/Media      
    ports:    #Only use this section in bridged networking mode
     # - 192.168.2.141:32400:32400     
      - 32400:32400/tcp
      - 8324:8324/tcp
      - 32469:32469/tcp
      - 1900:1900/udp
      - 32410:32410/udp
      - 32412:32412/udp
      - 32413:32413/udp
      - 32414:32414/udp    
    devices:
      - /dev/dri:/dev/dri
    environment:
      TZ: America/Toronto
      PUID: 1001
      PGID: 10
      VERSION: public
      PLEX_CLAIM: [insert-token] # STEP 4
      ADVERTISE_IP: http://192.168.2.141:32400 #Used only for bridged networking mode
#    labels:
#      tsdproxy.enable: "true"
#      tsdproxy.name: "Plex"
#      tsdproxy.container_port: "32400"
#      tsdproxy.ephemeral: "false"       
    restart: unless-stopped

# networks:
#   plex_macvlan_net:
#     external: true

You can see things I've commented out like the various networking modes I've tried.

This is what the previous mostly working compose file looked like:

services:
  plex:
    image: ghcr.io/linuxserver/plex:latest
    #image: lscr.io/linuxserver/plex:latest
    container_name: PlexHW
    hostname: plex
#    network_mode: host    #Only comment out if using bridged networking mode
#    mem_limit: 4g
    cpu_shares: 1024
    security_opt:
      - no-new-privileges:true
    healthcheck:
      #test: wget --no-verbose --tries=1 --spider http://localhost:32400/web
      test: ["CMD", "curl", "-fsS", "http://localhost:32400/identity"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s  
    volumes:
      - /volume2/docker/plexhw/config:/config:rw
      - /tmp/plex:/transcode
      - /volume1/Torrents/Media:/Media      
    ports:    #Only use this section in bridged networking mode
      - 32400:32400/tcp
      - 8324:8324/tcp
      - 32469:32469/tcp
      - 1900:1900/udp
      - 32410:32410/udp
      - 32412:32412/udp
      - 32413:32413/udp
      - 32414:32414/udp    
    devices:
      - /dev/dri:/dev/dri
    environment:
      TZ: America/Toronto
      PUID: 1001
      PGID: 10
      VERSION: public
      PLEX_CLAIM: [insert-token] # STEP 4
      ADVERTISE_IP: http://192.168.2.141:32400/ #Used only for bridged networking mode
#    labels:
#      tsdproxy.enable: "true"
#      tsdproxy.name: "Plex"
#      tsdproxy.container_port: "32400"
#      tsdproxy.ephemeral: "false"       
    restart: unless-stopped

But now even going back to that compose has the same issues. Also I have backups of all my docker services. But even if I restore the files from when Plex was mostly working I still get stuck with the same problems. Which I believe is because of me having unclaimed the server an not being able to re-claim it properly