January 11, 20251 yr Now that unraid 7 is in stable release. I thought i'd share my finding and settings... Tailscale is still new to me. I was hacked over its due to not realizing tailscale drop feature and having a ssh option enabled. its was a test machine and no data and other security stuff were implement ... hence what drove me away for security reason for some other free vpn options... as tail scale shouldn't have some things enabled nor on by default.... DOUBLE CHECK YOUR ADMIN CONSOLE CONFIG SETTING!... I looked at twingate and then unifi teleport... But for now lets review tailscale... Tailscale in this Example: If my tailscale dns is set to http://yourdevice.ts.net and I want to share plex though tail scale without the vpn client. I would need to use a tailscale funnel feature: While the gui options are there. I though it nice to share some tailscale terminal commands and fun with setting up and using tailscale. Hopefully to help others... especially though behind cgnat! tailscale up --accept-routes --accept-dns=false --advertise-routes=192.168.1.0/24 tailscale serve /plex http://192.168.1.2:32400/web/index.html tailscale funnel 32400 *Running --accept-dns=true will tell tailscale to overwire your host resolv.conf and has been known to cause soem dns isseus with some dockers... *there are workarouds and patches in place to assit here... As always review the DOCs! https://tailscale.com/kb/1464/funnel-vs-sharing https://docs.unraid.net/unraid-os/release-notes/7.0.0/#tailscale-integration https://docs.unraid.net/unraid-os/manual/security/tailscale/ What does the terminal commands do? tailscale up accept routes options: DOC: https://tailscale.com/kb/1019/subnets?q=acept+routes#advertise-subnet-routes With this when I tailscal vpn client connect i can access my 192.168.1.0 subnet main I can access anything my lan has access to my unraid system is at 192.168.1.254 and plex at 192.168.1.2 when connected I can go to 192.168.1.254 and hit unraids web interface over tailscale... TailScale Serve option the Docker gui options in unraid template set this... So, what does tailsacle serve do... DOCs: https://tailscale.com/kb/1312/serve For example what if i only want plex docker sent not my entire subnet? we use the serve option so tailscale serve command above when connected to the tailscale client VPN I can access plex by going to http://<tailscale-ip>/serve/plex and http://yourdevice.ts.net:32400/web/index.html Why use tailscale serve? Simplified Routing: The tailscale serve command doesn't require configuring port forwarding, firewalls, or additional DNS rules. It uses Tailscale’s built-in routing and security features to expose a service to your Tailscale network. Flexible Paths: You can serve specific paths (e.g., /plex) without exposing the whole port or service. This is useful if you have multiple services running on the same machine. TLS Encryption: tailscale serve automatically uses HTTPS for your .ts.net domain, ensuring encrypted connections without needing to manage certificates manually. Access Control: With Tailscale ACLs, you can restrict access to specific users or devices in your Tailscale network, providing more granular control than a simple DNS/port forwarding setup. example use case: TailScale Funnel: TO get around CGNAT! If I'm understanding this right... you can setup a portfoward without a Public IP port forwarding and without the vpn client to connect (this is a Tailscale Beta feature! atm...) https://tailscale.com/kb/1223/funnel when funneling: This opens port 32400 on your .ts.net domain and makes it accessible publicly via HTTPS. Requests to http://yourdevice.ts.net:32400 are automatically redirected to HTTPS (https://yourdevice.ts.net:32400). Benefits of This Approach Direct Access Without VPN: Users don’t need the Tailscale client; they can access Plex via a .ts.net domain from any device with an internet connection. HTTPS by Default: Funnel automatically provides TLS encryption. Integrated with Plex: No additional configuration is needed on the Plex side While this implementation is nice, while using Tails scale you should remember to follow security standards... Edited February 7, 20251 yr by bmartino1 fix data due to patches
January 12, 20251 yr @bmartino1 Great information. I will have to experiment with some of this. Thank you.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.