I'm looking to upgrade the functionality of my server but I am really confused about TailScale. I watched two sets of videos by Space Invader but like many of his videos they are so spesific, like "getting PieHole to run on tailscale" as a massive section of the video that I find them sometimes lacking in info that a noob like me is looking for.

Basically my server is mainly a media server. I currently run plex, a few 'arr apps, sabnzb and a torrent app.

I would like to add AudioBookShelf, AirSonix and NextCloud as well as start migrating my media from Plex to JellyFin. The thing is all these apps, unlike plex require me to religionise some way for the server to be contacted remotely. My understanding is Tailscale can do this relativity easily. I also really like the idea of being able to control my server, remotely.. and again, as I understand it, this is something tailscale is perfect for.

What I'm confused about is how to integrate the 'arr, nzb and torrent components of the media system. We have some draconian laws in my country so using a thrid party VPN service to obfuscate my IP and "hide" my online activity, as much as I can, is not a choice, it is an absolute necessity. So I HAVE to have these dockers run though a VPN. I am currently using Gluten for this.

1) As far as I can tell, there is no way to make a "exit node" in Tailscale to use a VPN service, so all outgoing traffic form that node is protected. The TailScale Blog talks about it in this post.... Mullvad on Tailscale: Privately browse the web... but as far as I can tell it is only able to do with using that spesific brand, while Glutun can use pretty much any provider.

I am pretty sure I make a Glutun Container and run the entirety of tailScale through it, all the exit nodes will be vpn protected, but it also means I can not have a exit point that dose not use the vpn.

2) The other option is to split my sever.. all my hosting app like JellyFin run through tailscale, but have the "leeching apps" disconnected from it, and all running through Glutun.... but if I setup that way, will I still be able to control those containers remotely, as in access say Radarr and add a new film or w/e. As I need to have the app running on tailscale to do this? Or is it that once i have the server itself on tailscale, and can acers the admin pannel of it, can I access the docker web interfaces that way?

3) Another option is to run two separate tailscales... one for the serving of media, and the other for the leeching and have that one running through gluten, but I am not even sure that it is possible to run two side by side tailscales as it is a system level plugin now and not a docker.

Maybe I am just confused about how it all works... .

: TL;DR :

How can I use tailscale to access my sever and the various web interfaces of my dockers, as well as connect to dockers with 3rd party apps, like say Jellyfin on my TV to JellyFin Server on tailscale, but STILL be able to use a 3rd party VPN service to mask my internet usage of various apps like Torrents and other Downloaders?

Thanks!

Edited October 25, 2025Oct 25 by questionbot

I think I have Tailscale working.... like I followed spaceInvaders instructions... but while it "looks" like it is working.. I can not use the urls in any remote apps... like if I install jellyfin on my tv and enter the talescale url, that works on my pc with the tailscale app installed... it will not connect?

Tail scale is a API web based VPN system. It uses WireGuard technology underneath. It use tailscale.net as a broker server to handle query and requests.

Tailscale has Known documents 3 setups for use.

Exit node: https://tailscale.com/kb/1033/ip-and-dns-addresses

Funnel mode: https://tailscale.com/kb/1223/funnel

serve mode: https://tailscale.com/kb/1312/serve

Depending on what your trying to do and how you want to interact with it.

I prefer to use a funnel or subnet route. As I don't want to have to connect to my tail net to access my connected services over the vpn.
This means I can setup example "docker name.tailscale name .net" and going to that link I can forward and access web passed systems like a reverse proxy, to access things like immich, plex, etc..

Unriad makes this fairly easy once you have the tailscale admin side setup... You first need to setup some admin things Especial if you want to funnel.
https://login.tailscale.com/admin/machines

Settings beta - funnel



Unraid Funnel example I'm using tailscale to vpn remote access my plex system (due to cgnat)...


You need to install the tail scale plugin. to start a docker needs to be in a acceptable docker network mode. Ipvlan/macvaln - docker Bridge network...

then fill in some bare min tailscale data info


*Note the tailscale serve option, this is where you can change it to funnel
Then check the docker log and grab the tailscale invite link and sign in to your tailscale account to add it to the list of machines.

Thats it that docker is now in the tailscale VPN. and if done correctly you can hit the plex web ui by goin to the 100 address or name.tailnet name address...

However, I prefer subneting for tailscale auth and access to my entire netwrok... What I normally do... to not have a end point and any device to be secured and protected. is not use server or funnel... nor exit node. I just want to have a device use tailscale and connect to my tail net. so each device that will access my network but auth and connect to my tail net...

with the plugin installed. (Only for the latest and current working unraid tailscale binary.
Install the plugin only and don't use the web ui to configure...

instead, use a user script plugin and run the tailscale up command your self like so:
(While possible to due with the plugin in the web UI I find it easier to just run the dam command...)




example script:
#!/bin/bash

tailscale up --accept-routes --accept-dns=false --advertise-routes=192.168.201.0/24


*You have to allow the subnet route in the tailscale admin console. And it will generate a tailscale link to grant you access.

Then any device conected to tail scale can ping and access a docker lets say i set plex to 192.168.201.254 via custom br0 (ipvlan/macvlan)

Since i'm vpn connected to my tailscale I can use that device connected and call 192.168.201.254 and hit plex without port forwarding no other access setups...

This allows the connected device anywhere in the world full subnet access to my class c 192.168.201.x so I can talk and access if i'm on that network or if i'm at my house. Samba share, other web services other devices... home assistant with remote locations...

So Tailscale is a VPN that can be used to remote access and secure access unraid system anywhere in the world.

Edited October 25, 2025Oct 25 by bmartino1
forum weridness with picture upload. spelling