I have installed tailscale into a few of my docker containers using the built-in Unraid 7 tailscale integration in the docker template.

If I run tailscale ping nextcloud from a machine on my own internal network (like my desktop PC), it can successfully ping the container directly.

But if I try to ping the same Unraid docker container from a remote machine on a different network (this remote machine is running ubuntu server), it always resolves through the DERP servers.

I can successfully tailscale ping this remote Ubuntu Server just fine from my desktop PC, my Unraid host, and even LXC containers with tailscale installed from my Proxmox machine on the same network.

The only hosts that cannot initiate direct connections to the Ubuntu Server remote are the Unraid Docker Containers with Tailscale enabled in the template.

To add some data, here is the output from running tailscale netcheck inside my Nextcloud container:

tailscale netcheck

2026/07/22 17:03:11 portmap: monitor: gateway and self IP changed: gw=172.20.0.1 self=172.20.0.3

Report:

* Time: 2026-07-22T07:03:12.898630468Z

* UDP: true

* IPv4: yes, my.wan.IP:47342

* IPv6: no, but OS has support

* MappingVariesByDestIP: true

* PortMapping:

* CaptivePortal: false

* Nearest DERP: Sydney

* DERP latency:

- syd: 22.7ms (Sydney)

- sin: 134ms (Singapore)

- hkg: 145.4ms (Hong Kong)

- tok: 173.1ms (Tokyo)

- dbi: 185.3ms (Dubai)

I would also like to clarify that I have enabled NAT-PMP on my home router (pfSense) and created ACL allow entries for my tailscale machines (desktop PC, unraid host, etc).
If I run the same command on my Unraid Host or my Desktop PC, PortMapping has the value PortMapping: UPnP, NAT-PMP, PCP.

All of these Unraid containers (nextcloud, jellyfin, etc) have their Network Type set to Custom : DockerNetwork which is just a custom docker network I created.

Edited Wednesday at 07:08 AM2 days by Stubbs

Have you enabled host access to custom networks in docker settings? By default, containers on a custom network are not allowed to talk to the host. That's probably why it's getting relayed. If you switch to the default bridge network, you'll see you'll get a direct connection. I personally don't have host access to custom networks enabled because of security, as I want as few things as possible to be able to talk to the host. But if you're interested, I can tell you a trick so that you can still use a custom network and only allow certain containers to talk to the host instead of enabling it globally; just say the word.

8 minutes ago, strike said:

Have you enabled host access to custom networks in docker settings? By default, containers on a custom network are not allowed to talk to the host. That's probably why it's getting relayed. If you switch to the default bridge network, you'll see you'll get a direct connection. I personally don't have host access to custom networks enabled because of security, as I want as few things as possible to be able to talk to the host. But if you're interested, I can tell you a trick so that you can still use a custom network and only allow certain containers to talk to the host instead of enabling it globally; just say the word.

Using Bridge Network is not an option. For reasons I don't understand, it has a side effect preventing the container from connecting to the internet, and is only able to resolve machines on the same tailnet. For example, if I set Jellyfin to Bridge Mode, curl ifconfig.io won't resolve, and it won't fetch movie banners and posters, but devices can still connect to it.

I tried doing what you suggested, enabling host access to custom network in Docker Settings. Unfortunately it didn't fix the issue. tailscale ping still uses the DERP servers and fails to establish a direct connection. In fact, the same thing applies even when I put the container in Bridge Mode.

Everything other than Unraid's docker containers can establish direct connections to this remote server. Even Proxmox LXC containers can directly connect to the remote. This leads me to believe there is something related to Unraid's Tailscale implementation that restricts direct connections over Tailscale.

Can you run this on the server, does it have tailscale dns enabled?

tailscale dns status

if it's enabled run this:

tailscale set --accept-dns=false

Then try pinging a container in bridge mode again. You might have to restart the container.

18 minutes ago, Stubbs said:

This leads me to believe there is something related to Unraid's Tailscale implementation that restricts direct connections over Tailscale.

Nothing is wrong with Unraid's Tailscale implementation; I have direct connections working fine.

I forgot one thing, you might need to open up port 41641 UDP in your pfsense firewall.

21 minutes ago, strike said:

Can you run this on the server, does it have tailscale dns enabled?

tailscale dns status

if it's enabled run this:

tailscale set --accept-dns=false

Then try pinging a container in bridge mode again. You might have to restart the container.

Nothing is wrong with Unraid's Tailscale implementation; I have direct connections working fine.

Ok, --accept-dns was enabled so I set it to false. This fixed the issue of containers like Jellyfin not being able to connect to the internet (curl ifconfig.io now resolves), however pinging to and from the remote server to an unraid docker container still routes over DERP.

6 minutes ago, strike said:

I forgot one thing, you might need to open up port 41641 UDP in your pfsense firewall.

I have more or less done the same thing by going to Services>UPnP, enabling port mapping and Allow PCP/NAT-PMP Port Mapping and creating an allow rule for the Unraid Server with a port range of 53-65535.

This is what the Tailscale Documentation recommends: https://tailscale.com/docs/integrations/firewalls/pfsense

Edited Wednesday at 09:35 AM2 days by Stubbs

8 minutes ago, Stubbs said:

I have more or less done the same thing by going to Services>UPnP, enabling port mapping and Allow PCP/NAT-PMP Port Mapping and creating an allow rule for the Unraid Server with a port range of 53-65535.

It should do the same thing yes, for your server. But you have been trying to ping containers on a custom network and not the server so just humor me and open up port 41641 and see if that helps. Also, if you have Tailscale on your phone, try pinging the container from there on a mobile connection. And in the unraid webui under tailscale->status just to see if you get a direct connection from the server to the container.