If enabling a proxy improves metadata access but breaks remote access in Plex, start by checking your routing rules. That said, "every remote access failure is caused by the proxy" simply isn't true.
First, Separate the Three Connections
When your Plex server fetches posters and metadata, that's outbound traffic. When it registers its connection info with Plex's services, that's also outbound. But when a remote client connects to your Plex server at home, it depends on an inbound path that's actually reachable.
Diagram: Plex — outbound requests and remote inbound access are not the same path
A proxy can change the exit address the outside world sees, and it can make registration or probing use a different path. That's one avenue to investigate — it doesn't prove that's what's causing your problem.
Check Things in Order
First, confirm that clients on your local network can reach Plex directly. Then check whether your router's public address is genuinely reachable from the outside. Double NAT and CGNAT can't be fixed just by tweaking routing rules.
If you're mapping ports manually, forward a specific external TCP port on your router to TCP 32400 on the Plex host, and enter that external port in Plex's remote access settings. Don't assume the external port has to be 32400. Also check whether the host firewall or the target address has changed.
Test from a genuinely external network, like your phone's mobile data — don't just test loopback access from inside your LAN. And a dashboard that briefly shows green isn't enough to prove every client path is working.
Then Check the Proxy and DNS
Back up your current rules first, then look at which path Plex's registration and probe requests are actually taking. If you need to make changes, only adjust the domains or device rules you've confirmed are relevant, then compare behavior with the proxy on and off.
Routing all of *.amazonaws.com as direct is far too broad to serve as a default rule. It's also not a good idea to force every Plex metadata domain through a single exit and then claim that fixes all remote access problems.
Secure connections can also be affected by DNS rebinding protection. Plex's official guide to secure connections explains how to handle plex.direct. Configure an exception for that domain in whatever DNS service you use — don't turn off rebinding protection entirely.
Port Reachability and Playback Permission Are Two Different Things
A working network connection doesn't necessarily mean your account can stream remotely under the current product rules. You also need to check whether you meet the applicable requirements, such as Plex Pass or Remote Watch Pass. Figure out first whether you're dealing with a connection failure, a Relay connection, or a playback permission prompt — then look for the matching fix.
If your troubleshooting involves a Plex Token, never post the full URL containing the token in comments, screenshots, or public logs. Mask the credentials in the URL when you're asking for help.
References: Remote access troubleshooting, Secure connections and DNS. This article has been corrected against the official documentation. It has not modified your router, proxy, or Plex service.