EDACerton

Please post diagnostics from inside the Tailscale settings.

You seem to be stuck on a very old version of the plugin, and for some reason Unraid is "stuck" trying to install that version. I would try going to "Plugins" -> "Install Plugin", and use this for the URL: https://raw.githubusercontent.com/dkaser/unraid-tailscale/main/plugin/tailscale.plg If that doesn't work, I would do the following: Open the CLI. Run the following command: rm /boot/config/plugins/tailscale.plg Reboot the server. Reinstall the plugin. This will retain your Tailscale state, but will make Unraid "forget" about the plugin completely, which will hopefully clear out whatever is causing that old version to be cached.

If you switch to the "Advanced" view in the Tailscale settings, there's an option for Wireguard Port:

Yes.

The ways that "Use Tailscale Subnets" causes problems has to do with how other Tailscale devices are set up. One important thing to understand -- "Use Tailscale Subnets" has nothing to do with setting your Unraid server up as a subnet router. If you want to advertise routes from your Unraid instance, go for it -- that works just fine (and lots of people do it). "Use Tailscale Subnets" is relevant when *other* devices on your network are a subnet router (for instance, folks who use things like pfSense/opnsense/etc. for their firewall/router sometimes like to install Tailscale there and use it as the subnet router). In cases like this, you can run into some asymmetric routing issues because now you'll actually have two routes to your local network (directly connected and via the Tailscale subnet router)... and Tailscale will try to force the traffic to go over the subnet router*. However, the router isn't expecting that traffic, and the client isn't expecting for the traffic to come back that way either, so this can result in various (and weird) connection issues. In practice, there are very few scenarios which would require "Use Tailscale Subnets" to work. Without "Use Tailscale Subnets", you can still: Configure Unraid as a subnet router on Tailscale to make other devices on your network accessible via Tailscale. Connect to Unraid via its local IP from another device via a subnet router (e.g., connecting to 192.168.1.10 from your laptop, with Tailscale installed as a subnet router on your firewall). What you cannot do is: Connect from Unraid to a device in a remote subnet (e.g., if you had a subnet router running at your friends house, and you wanted to transfer files from Unraid to a device there via the subnet router). * This seems like a bad thing, but is actually a good feature that just has unfortunate implications in this scenario. Tailscale behaves this way because many private networks share IPs, and by forcing all traffic over the subnet router, it guarantees that when you enter (for example) 192.168.1.10 it connects to your server and not some device on another network that just happens to use 192.168.1.0/24.

tailscale0 is from the Docker container, not from the plugin. Do you have the plugin installed? If so, please provide diagnostics from within the plugin settings.

Tailscale SSH doesn't have anything to do with accessing file shares. I would recommend turning that off if you aren't familiar with what it does. The problem that you're having is covered in the common problems part of the support thread: Turn NetBIOS off in your settings.

You need to get the diagnostics from inside the Tailscale settings (there's a button there). That collects more information than the default diagnostics do.

If the plugin and docker were running at the same time at any point, they can fight with each other and cause issues. I would start by removing the Docker container entirely, then rebooting the Unraid server so that any lingering network pieces get cleared out. If that doesn't work, post diagnostics over in the plugin support thread and I'll take a look.

Thanks for this! I'll get it added into an upcoming update. I might try to add some extra logic as well to detect if the certificate has renewed, this would let the check be run more frequently. (This is to avoid a scenario where running monthly misses the certificate renewal window, or if it gets missed for some other reason like your server being restarted for updates at the exact wrong moment, Tailscale down for a few minutes, etc.) I've been meaning to look at automating the SSL configuration for the WebGUI, but I'd been hesitant to do so early on since that potentially requires changing system settings too (domain name must be the Tailnet name, enabling SSL, etc.). I'll have to give that some more thought now that the plugin is a little more mature.

Dieser Teil ist falsch. Das Plugin verwendet tailscale1, nicht tailscale0. Es wird vom Plugin automatisch zur Liste hinzugefügt.

Möglicherweise müssen Sie die Schaltfläche „Neustart“ in den Plugin-Einstellungen verwenden. Das behebt manchmal Probleme nach der ersten Anmeldung bei Tailscale. Wenn das nicht funktioniert, erfassen Sie bitte die Diagnose in den Plugin-Einstellungen, ich kann einen Blick darauf werfen. (Dieser Beitrag wurde über Google Translate erstellt. Ich entschuldige mich, falls etwas verwirrend ist.)

This is exactly how I run my containers 😀

There isn't anything that the plugin can do to fix network mapping. One thing to check -- some firewalls require additional configuration to make things play nicely. Look at https://tailscale.com/kb/1181/firewalls to see if there might be more that you need to do.

I added a template that installs the official Tailscale Docker container, it is available in CA as "Tailscale-Docker". The official container should be suitable for the advanced use cases which require a separate Tailscale instance.

Tailscale - Docker Container This provides the official tailscale/tailscale Docker container. This container is only intended for advanced networking configurations (br0 networks, creating a separate Tailscale node for sharing Docker containers, etc.), so it is expected that you know what you are doing. Support will not be provided for using this container to access Unraid resources (WebGUI, shares, etc.). To access Unraid resources, install the Tailscale plugin instead: Description Tailscale is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly. The service handles complex network configuration on your behalf so that you don't have to. Network connections between devices pierce through firewalls and routers as if they weren't there, allowing for direct connections without the need to manually configure port forwarding. Configuration This container can be configured as either an ephemeral or persistent Tailscale node. To create a persistent node: (Optional) Generate an authentication key in the Tailscale admin console. Set Hostname, State Storage, and (if applicable) Authentication Key in the container configuration. If you did not set an authentication key, open the container logs to obtain the login URL to join the node to your tailnet. Caution: If you use this method, you must complete the login within 60 seconds of the container starting. Otherwise, the container will stop, and you will need to start it again (with a new 60 second timer). To create an ephemeral node: Generate an ephemeral authentication key in the Tailscale admin console. Set Hostname and Authentication Key in the container configuration. Leave State Storage blank.

There are a couple of solutions if you want to limit access via Tailscale:\ Use Tailscale ACLs. While the free plan provides limited control with ACLs, it does include "autogroup:shared", which you can use to limit access. For example, something like this: { "acls": [ // Allow all connections for users joined to the tailnet. { "action": "accept", "src": ["autogroup:member"], "dst": ["*:*"] }, // Only allow shared-in users to access the Unraid server on ports x,y,z { "action": "accept", "src": ["autogroup:shared"], "dst": ["my.unraid.tailscale.ip:x,y,z"] }, ] } You can create a second Tailscale node using a Docker container, then "sidecar" it to the containers that you want to share. (Note: don't do this today, the existing Docker container is being discontinued... I plan to add a template for the Tailscale official docker container for this use case, but that won't be up for another day or so.)

I'm not sure why you would be running the sysctl commands, those aren't required with the plugin (it does all of that automatically). For the DNS issue -- unless you have a reason that your Unraid server needs to be able to resolve *.ts.net names, set "Use Tailscale DNS Settings" to "No" in the advanced settings for the plugin.

I can look at the settings for the iframe, but I can't make any promises there. Changes to benefit one screen resolution can have side effects for other resolutions. I'm not going to try to inject HTML/CSS changes into the built-in interface to add a dark mode setting. That's generally bad/last-resort practice and sets the plugin up for problems later on as Tailscale makes changes to the interface. If you want dark mode support in the Tailscale web client, please submit a PR to Tailscale to add the feature upstream.

Dark mode: no, the page inside the iframe is actually provided by Tailscale itself, any change there would have to be added via github.com/tailscale/tailscale. Why are you asking about the iframe dimensions?

I see that your Jellyfin container is configured to use host networking; is there a reason for that?

Are you able to connect from home-desktop-pc? I can see some MDNS traffic in the logs that seems to be OK. I also see some weird "no associated peer node" messages in the logs. That makes me think that something either on the server or the clients isn't connected correctly. I would try either logging off/logging on to the clients, or erase the Tailscale plugin configuration (there's a button in the settings) and then try connecting the server again.

This doesn't seem like something that I can fix in the plugin. I can't think of any reason why Tailscale would use a different route than what the rest of the Unraid instance would. My recommendation would be to make a post in somewhere like r/Tailscale, there might be someone there who has tried a similar setup.

Looking at this... if you had installed 2024.05.11, that would have likely cause issues with your Docker networking. The later versions correct this issue. As for the Let's Encrypt errors, that doesn't seem to be Tailscale related. Let's Encrypt can't resolve the DNS address that you're trying to generate a certificate for: DNS problem: NXDOMAIN looking up A for sab.redswitch.co.uk

In theory, yes -- although this isn't something that I've expressly tested (on my to-do list).