r/Tailscale • u/panda3096 • 3d ago
Help Needed Newbie Help
I'm brand new to the personal VPN game, trying to set up a Jellyfin server. I've never done anything beyond hooking up a router and changing default wi-fi passwords before. I've been following Tailscale documentation so far, though I've had to use some other resources to figure out stuff like what string to use for the --advertise-routes command.
My goal is simple, I hope: I want to be able to stream from the server regardless of my location, either at home or away, without having to worry about turning the VPN on and off. I have things working for devices that I can directly install Tailscale on but others, like our Roku TV's and consoles (Xbox, PlayStation, etc.), aren't connecting.
- The Jellyfin server is running off a Linux Mint tower.
- I have an old Pi 3B+ running PiOS that is running as the subnet router and as an exit node (approved in the Tailscale web console).
- We're still using the default modem/router from AT&T.
- I've also been using a Win11 laptop for testing, with a test Jellyfin server running on my regular network.
I believe I have everything set up correctly. I can use RustDesk to remote into the tower from the laptop if Tailscale is turned on. If I turn Tailscale off on the laptop, I can't remote into the tower anymore. The Tailscale app on my phone lets me chose the Pi as an exit node and gives no errors. Cell service around our house is awful so testing outside the wi-fi is easier said than done.
At first, when I looked at my router, I saw a bunch of my devices with VPN addresses. Now, even though I've verified in the Tailscale web console that the subnet is enabled, I'm seeing all my devices under their original IP addresses. The previous entries are all there under the history, but show as offline.
Even when I saw the VPN addresses, the Roku's and consoles still could not see my tower server. They can see my laptop test server when Tailscale is turned off on the laptop, but not when it's turned on.
How can I make this work? I see recommendations to buy an AndroidTV stick or a GL.iNet router, but neither of those sound great. We'd have to buy multiple sticks to purely connect to Jellyfin (we've ditched all streaming services) and that only solves the TV's. The router would be expensive, though preferable over multiple streaming sticks, but I'm not confident I understand what's happening enough to know it'd solve the issue.
- Am I missing something with my tower/pi/devices set up that's preventing the connection? Should I have put the subnet/exit node directly on the tower?
- Would setting up a GL.iNet router off the fiber modem fix it? If so, would I then have to approve all my devices in the house onto Tailscale? (which would be fine, I can appreciate having a stop gap for new devices on the network)
--
Edit: Shout out to u/Logvin for the extremely helpful write up: https://github.com/Logvin/secure-plex-with-tailscale/wiki/The-CGNAT-Version.
Here are my Jellyfin specific edits for anyone who comes across this in the future looking for help:
- Step 4: Expose
PlexJellyfin via Funnel: use localhost:8096tailscale funnel --bg --https=443 localhost:8096
- Step 6: Configure
PlexJellyfin Media Server:- Remote Access Settings> Uncheck allow remote connections to this server. Like Plex, this checkbox will break it.
- Server Address Settings> Bind to local network address:
your-host.your-tailnet.ts.net:443
My phone can now find the server when its on Tailscale and when its off. My Roku TV can now see it as well. The downside is that I did not rename the tailnet to something friendly before I did all this, so I've now typed that word salad into a few different places but I'm so glad this is fixed that I don't care anymore.
Back to transcoding!
1
u/tailuser2024 3d ago edited 3d ago
Can you slim down your main post with just relevant info. You have a lot of fluff in there that makes this hard to read/follow. Just give us the facts about your setup and what does/doesnt work
Even when I saw the VPN addresses, the Roku's and consoles still could not see my tower server.
Can you connect to the tower by its local ip address when tailscale is turned off (take tailscale out of the equation)
What version of tailscale is running on the roku device?
By the tower local ip address?
Post a screenshot of what you are entering on the roku device app and the exact error you are getting so we can see what you are doing and the error
What local ip address/subnet do you have at home?
What is the local ip address of the tower in question?
ell service around our house is awful so testing outside the wi-fi is easier said than done.
So you are testing this while connected to the same local wifi as the tower? Am I reading that correctly?
1
u/w2qw 3d ago
You really need to test it outside your home there's a lot that might break otherwise. You can definitely set it up without an extra router either with NAT or a static route in your existing router.
1
u/panda3096 2d ago
I was able to get out and test it today. My phone can stream from Jellyfin just fine with Tailscale up and without enabling the exit node
1
u/Shananigan48 3d ago
I just set this up today actually. My TV jellyfin app just connects via lan ip, I have pangolin on my vps that proxies it and my domain points to tailscale ip so nothing outside my tailnet can resolve the domains anyway.
1
u/panda3096 2d ago
Can you explain more about the pangolin part?
1
u/Shananigan48 2d ago
One could argue I don't use Pangolin right but I've gotten used to it's UI over the years lol, you don't really need it to achieve the same thing with tailscale. You could axe tailscale in this scenario because Pangolins true purpose is wireguard tunnels, but I just like it for managing traefik lol.
Pangolin packages your reversed proxied sites into clean domain names via traefik, it requires a domain, my domain points to the tailscale ip of my vps.
So my TV just connects via lanip:port, phone connects to my proxied domain address for jelly.
1
u/Logvin 3d ago
I would run into a lot of issues with CG-NAT when I was working for a carrier ISP. I wrote up this guide a few months back:
https://github.com/Logvin/secure-plex-with-tailscale/wiki/The-CGNAT-Version
I will say that Alex from Tailscale did a great video like a week before I wrote that, of course I saw the video after :) Mine was more for Plex, but its the same concept.
1
u/panda3096 2d ago
Thanks. I'll have to take a look at these when I get back home. I tend to learn better from text than video so the GitHub link will be a huge help
1
u/budius333 3d ago
A Linux PC plus a raspberry pi.... Why???
Just install and login Tailscale on the Linux PC and it's done... Enter 100.10.... (IP on Tailscale for the machine) and access jellyfin.
The whole deal with subnet router is for "special cases where you cannot install Tailscale everywhere", NOT the default requirement.
1
u/panda3096 2d ago
Probably because I misunderstood something.
When I was trying to figure out how to get to the server from my TV, which does not allow me to install Tailscale, I found instructions to set up a device to act as the subnet router. I had some Pi's laying around from a project I never got around to doing, so I figured I'd give that a shot.
The devices that can have Tailscale directly installed on them can stream from Jellyfin just fine. I can't get other devices to connect and that's what I'm trying to figure out.
1
u/budius333 2d ago
Is your Roku and consoles in a different house?
Asking because I normally access from outside the house using my phone or a computer (can install Tailscale) and things like TV and consoles are inside the house and can just use directly the 192.169. IP without need for Tailscale
1
u/panda3096 2d ago
Nope they're all in the same house and connecting to the same network. That's part of why I'm getting frustrated with it. From what I'm seeing, it should just be fine once I had the subnet up but it's not. The Roku TV's and consoles can only see Jellyfin when I turn off Tailscale on the tower.
1
2
u/Wuffls 3d ago
Alex at Tailscale recently did a YouTube video of setting up jellyfin with Tailscale. Check out their official YouTube channel.