I’m getting an auth error related to an incorrect username and password when attempting to share a network folder I have mapped in Windows 11. This network folder uses different credentials than my current Windows 11 user.

Has anyone shared a mapped network drive in Windows 11 using Taildrive before?

I run Plex (lifetime pass) on our home server (via Unraid) and want to start sharing my library with a few friends and family members. From what I've read in the past, Tailscale is widely considered the most secure way to share Plex access remotely, etc. However, the thing I can't wrap my head around is that I'm pretty sure most of the people I would want to share with wouldn't necessarily be accessing the library on their computers but instead on living room streaming boxes like Rokus, Apple TVs, etc. Is Tailscale/Plex in any way compatible with those types of devices? If yes, is it straightfoward enough that I could document and/or explain it to them effectively (think, your parents trying to navigate this)? Appreciate any and all feedback as I consider how best to go about this. Thank you!

Hey everyone,

​I'm using Pi-hole as my main DNS server for my Tailnet, but I've run into an annoying issue: for some reason, the Tailscale IP address of the node running Pi-hole keeps changing randomly.

​Because the IP changes unexpectedly, my devices lose DNS resolution out of nowhere until I check the admin console and update my configuration.

​Context:

- ​Pi-hole is installed in the same LXC running my main Tailscale route node.

- ​The host machine has a static local IP on my LAN.

- ​There are no duplicate hostnames on my Tailnet.

​Has anyone else run into this issue?, What could cause a native Tailscale node to change its IP address like this?

​Any advice or troubleshooting tips would be greatly appreciated!

I set up Immich months ago on one of my Linux machines via docker. I access it through that machines Tailscale IP and port 2283 over http.

Last week I set up Seafile on that same machine with docker and WebDAV enabled and can access it with the IP of the machine at port 8080. In order to access the seafdav on my iPhone I had to turn on https in Tailscale and sudo tailscale serv —bg IP:8080 and it works with https and magicdns.

How do I make it so I can access Immich through https at the same time on the same machine?

Hi y'all,

I'm not particularly adept at server/networking stuff so my apologies if I'm using terms incorrectly. Last night I was able to get tailscale running inside a docker container on my home hobby server and it's running as a funnel and I can access it on the open internet from a domain similar to this "https://subdomain2.subdomain.ts.net/home" however I'm struggling to figure out what DNS records I need to put in at my registrar to adequately get subdomain.mywebsite.com to point at the application running in the docker container that is accessable at https://subdomain2.subdomain.ts.net/home

I've currently got an A record pointed at the IPV4 address but that page in the website subdomain just never fully loading as if its just stuck waiting on a server response.

I'm not sure if there's some setting in Tailscale I need to change or command I need to run to allow that sort of access but any help would be appreciated

Hey everyone,

I’m a huge fan of Tailscale for mesh networking and I love the way Control D handles dynamic DNS routing. But I always wished I had a simple, self-hosted way to combine their power: running multiple VPN tunnels side-by-side, using them as Tailscale Exit Nodes / App Connectors, and managing a custom DNS Control Plane for my Tailnet.

Setting up isolated exit nodes with custom outbound VPNs (WireGuard, NordVPN) or split tunneling manually usually requires wrestling with network namespaces, iptables/nftables, and complex DNS configs.

So I built Hermit to make this instant — packaged entirely inside a single Docker container with zero external database dependencies:

⚡ What it does:

• Single Docker Container Setup: Everything (web UI, DNS engine, netns orchestrator, SQLite) is packaged inside one single container. No complex multi-container stacks required.
• Multiple Tunnels & Exit Nodes: Spin up multiple independent connection pairs side-by-side in isolated Linux network namespaces (netns) without route leaks or host network conflicts.
• Domain-based Split Tunneling (Tailscale App Connector): Easily configure domain-based split tunneling via Tailscale App Connectors. Simply input your target domains in the UI, and traffic for those domains is automatically routed through your specific tunnel across the entire Tailnet.
• Tailscale Integration & Outbound Routing: Pair any Tailscale node with outbound profiles (WireGuard, NordVPN, or Local interface).
• Control D-inspired DNS Control Plane:
  • Automatically provisions Tailscale DNS Nodes on your tailnet with built-in blocklists (AdGuard, GoodbyeAds) and custom domain routing rules (Block, Bypass, Redirect, Forward).
  • Auto-sets the DNS node as your tailnet-wide nameserver with one click.
  • Generates secure DoH endpoints and Apple .mobileconfig profiles for iOS/macOS.

🔗 Code & Repo

• GitHub: https://github.com/quaywin/hermit

I’d love to hear your thoughts, feedback, or ideas for new features. Thanks for checking it out!

Hi, i'm having a hard time trying to access my services using tailscale as VPN when i'm not at home. Tailscale is giving me the error "DNS not available" and when i use my domain name to access my services (services.domain.dedyn.io) it return ERR_NAME_NOT_RESOLVED

This is my current situation:

I have adguard selfhosted and i used the following docker compose

services:
  adguard:
    image: adguard/adguardhome:latest
    container_name: adguard
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
    volumes:
      - ./work:/opt/adguardhome/work
      - ./conf:/opt/adguardhome/conf
    networks:
      - caddy_net
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - DAC_OVERRIDE
    mem_limit: 512m
    cpus: 1.0

networks:
  caddy_net:
    name: caddy_net
    external: true

Every services is running fine on my machine at 192.168.1.88

and on adguard i have both the dns rewrite *.domain.dedyn.io -> 192.168.1.88 and the filter rules

||sh.dedyn.io^$dnsrewrite=NOERROR;A;192.168.1.88,client=192.168.1.0/24

||sh.dedyn.io^$dnsrewrite=NOERROR;A;100.90.122.98,client=100.64.0.0/10

this is my firewalld configuration (i'm using fedora server)

FedoraServer (default, active)
  target: default
  ingress-priority: 0
  egress-priority: 0
  icmp-block-inversion: no
  interfaces: eno1
  sources:
  services: dhcpv6-client
  ports:
  protocols:
  forward: yes
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
rule family="ipv4" source address="192.168.1.0/24" service name="ssh" accept
rule family="ipv4" source address="100.64.0.0/10" forward-port port="1-65535" protocol="tcp" to-port="1-65535"
rule family="ipv4" source address="192.168.1.0/24" port port="53" protocol="udp" accept
rule family="ipv4" source address="192.168.1.0/24" port port="443" protocol="tcp" accept
rule family="ipv4" source address="192.168.1.0/24" port port="53" protocol="tcp" accept
rule family="ipv4" source address="192.168.1.0/24" port port="80" protocol="tcp" accept
rule family="ipv4" source address="192.168.1.0/24" port port="443" protocol="udp" accept

the dns and caddy are listening on all interfaces

• tcp LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("docker-proxy",pid=662930,fd=8))
• tcp LISTEN 0 4096 0.0.0.0:53 0.0.0.0:* users:(("docker-proxy",pid=1047528,fd=8))

Now from tailscale

1 - i can ping my android device from tailscale dashboard
2 - i can ping my fedora server from my android device using the tailscale app

I have changed the DNS in split dns on "domain.dedyn.io" and pointed it at the tailscale ip of my fedora server

I would really like some help to know what i'm doing wrong

if you need more information don't hesitate to ask

Two Tailscale things worth discussing, one a genuine footgun I lost time to.

The footgun: exit-node clients ignore your tailnet DNS settings. I run an exit node so roaming devices get my full filtering + VPN stack from anywhere. What I didn't know: exit-node clients ignore the tailnet Global DNS and Override settings entirely (this is by design, confirmed in Tailscale issues #8237 and #5875). Client DNS gets delegated to the exit node's own host resolv.conf, not the admin-console DNS you configured. The iOS "Using Tailscale DNS" checkmark is cosmetic in this mode.

The result: my exit node's resolv.conf was pointed at the wrong place, so every roaming device resolved via my upstream VPN's DNS and fully bypassed my Pi-hole. Ads served everywhere, and the admin console said everything was fine. The fix was pointing the exit node host's resolv.conf directly at my Pi-hole, plus a policy-routing rule so the node's own tailnet-sourced traffic reached peers correctly. Only after both did filtering actually apply to roaming clients.

The design: chaining. My exit node isn't the internet egress itself. It sits in front of a self-hosted WireGuard gateway to a commercial VPN, so the path is device -> Tailscale exit node -> self-hosted WireGuard -> VPN. That gets me identical egress and filtering on cellular as I have at home, without putting the VPN app on every device.

Discussion: has the exit-node DNS delegation bitten anyone else, and how did you verify your roaming clients are actually using the resolver you think? And for the chainers, are you nesting an exit node into another tunnel like this, or keeping Tailscale purely for mesh and handling egress separately? Interested in where the chaining approach breaks down for people.

So I emailed them and cancelled Mullvad. Got a nice email back, they are looking for alternatives.

Hi, i started using Tailscale to connect my devices, my configuration is the following: I have a X86 machine with proxmox and different services on it, i use a windows desktop at work with wsl2 for accessing the home server while i am outside and for the offsite backups, a laptop with linux and an android smartphone. I am currently, and during the last months, using reverse proxy with NPM and duckdns to access my home server and everything is working perfecty but i am interest in moving towars Tailscale. So, i installed tailscale on proxmox and exposed my 192.168.1.0/24 subnet, I installed Tailscale client on windows at work, on my linux laptop and on my smartphone. When i type "Tailscale status" both on proxmox and on my windows desktop on powershell i see that the devices are shown as Active - direct, so everything seems good, i can access all my home services on browser (such as haos, immich, nextcloud, jellyfin, my router dashboard, ect...) but when i try to download something, i.e. from nextcloud or immich, or when the script in wsl rsync my backups, i see that the transfer speed goes up and down, reaching 0K for a few seconds, goes up again but with low speed and then drop again. For context i have 700mbps at home and 35/40mbps at work, download speed with tailscale reach 2,5MB/s in perfect conditions but began to drop really fast. So the real big issue is not the speed limit but the instability of that, continuing dropping or stopping and starting.

Is there something that i have done wrong? I tryed a lot of different things and changes with the help of Claude but nothing worked.

If you need more informations feel free to ask!

Sharing a project that leans entirely on Funnel. durbin is an npm package that lets you drive Claude Code from your phone while watching a live preview of your dev server.

The Tailscale part: on startup it runs tailscale funnel for its port by itself, grabs your DNS name from tailscale status, and prints a QR code with the full URL. So the entire setup is npm i -g durbin and running durbin in a project. No port forwarding, no reverse proxy config, and if Funnel isn't enabled yet it walks you through the one-time steps.

Auth on top of Funnel is a random token in the URL (set as a cookie on first visit) or an optional scrypt-hashed password, since Funnel exposes the port to the whole internet.

Happy to answer questions about the Funnel integration, and open to suggestions on doing it better.

EDIT : I created a Tailscale tag with ACL grants to access Plex, then connected two new devices (Android tablet + a connected TV) to Tailscale via the QR code login method, and attached the tag to those devices afterward. Logged into Plex with a different account than mine on both, everything works perfectly: recognized as local, no remote paywall.

Hi everyone,

I'm trying to understand a strange issue with Plex over Tailscale.

Setup

• Plex Media Server running in Docker on a NAS.
• Tailscale installed directly on the NAS.
• Plex is not exposed to the Internet and I don't want to expose it.
• The only way I want to access Plex is through Tailscale.
• No Plex Pass.

My setup

Let's call them:

• Location A: where the NAS is physically located.
• Location B: where I normally live.
• Location C: where I'm currently staying with family.

For months, I've been accessing my Plex server from Location B over Tailscale without any issues.

From Location B:

• Plex iOS app ✅
• Plex TV app ✅
• Plex Web on PC ✅

Everything works as expected and Plex behaves as if the connection is local.

The problem

I'm now at Location C.

When connected to the Wi-Fi there with Tailscale enabled:

• I can reach the NAS.
• Frigate and qBittorrent (also running in Docker) work perfectly.
• tailscale status shows a direct connection (no DERP).
• I can open Plex Web directly using the NAS Tailscale IP or MagicDNS hostname.

However:

• The Plex iOS app considers the server Remote.
• Plex Web on the iPhone also reports the connection as Remote.
• Since I don't have Plex Pass, playback is blocked.

The really confusing part:

If I disconnect from the Wi-Fi at Location C and switch to 5G (still with Tailscale enabled):

• Plex iOS immediately works again.
• Plex Web works.
• Playback works normally.

So:

• Location B (Wi-Fi + Tailscale) → ✅ Works
• Location C (Wi-Fi + Tailscale) → ❌ Remote
• Location C (5G + Tailscale) → ✅ Works

Things I've already checked

• Plex updated to the latest version
• Restarted Plex
• Disabled iOS "Limit IP Address Tracking"
• Other Docker services work perfectly over Tailscale
• Accessing Plex directly via its Tailscale IP or MagicDNS hostname works

Question

Has anyone seen a specific Wi-Fi network cause Plex to classify a Tailscale client as Remote, while the exact same device works perfectly over another Wi-Fi network and over 5G?

Hey everyone,

I'm running Nextcloud AIO in Docker behind an Nginx reverse proxy (Unraid server). Currently it's exposed via DynDNS + port forwarding on 80/443, but I want to lock it down to Tailscale only and close those ports on my router.

Has anyone successfully set up Nextcloud AIO with Tailscale as the only access path? Specifically wondering about:

• Trusted domains: AIO's Docker env vars (NEXTCLOUD_TRUSTED_DOMAINS) are only read on first start. Did you set additional trusted domains via occ afterward?

• HTTPS: Are you using Tailscale's built-in cert (MagicDNS + HTTPS), or your own reverse proxy cert? Any issues with overwriteprotocol or forwarded_for_headers?

• Mobile clients: Does the Nextcloud app work over the Tailscale IP/hostname, or did you need extra config?

• Drawbacks: Anything that broke or doesn't work over Tailscale-only access?

I'd rather not keep any ports open on the router if I don't have to. Appreciate any real-world experience! 🙏

Tailscale's MagicDNS isn't working on my phone. The client connects without an issue, but URLs to my home services (http://MYHOMESERVER:PORT) don't resolve when I try accessing them. They work fine if I use the IP address instead of the hostname. Works fine on the rest of my family's phones.

I think the issue is that I have a custom DNS server (ad-blocking) set in my phone's Android settings. That's the only significant difference between my phone and theirs. Is there a setting in Tailscale or Android that I'm overlooking where I can force it to use Tailscale's MagicDNS where it's needed?

Looking to know if there is an iOS app that will show what type of tailscale connection is in place as well as any other applicable stats like usage and time. Anyone know of an app that can do this?

Would anybody know why I am able to ping an IP address over the tail net, but unable to access the IP in Chrome or SMB?

There is this specific Windows 11 computer on my tail net, and I am unable to access SMB shares or IP addresses on this computer, however I can ping them when connected to the Tailnet.

Is Apple signin down? Trying to sign in on one of my devices through Apple ID and it keeps telling me page can’t be reached. So now I can’t sign in

My headless agent-runner boxes sit on the tailnet with no public ingress and no forwarded ports. Tailscale SSH handles auth so there are no long-lived keys on the runners, and I drive sessions from my laptop or phone over the same connection.

I was perusing through the Tailscale configuration information within Home Assistant OS and saw that were was a toggleable option to advertise as a app connector. After reading the description within HA and the TS documentation, I didn't seem like it necessarily applied to my use case. Is enabling TS as an app connector necessary in HA/smaller setup? In a simpler home lab setup, what would be the purpose of an app connector? Does running TS in HA as an app connector cause any issues?

Sorry for my many different questions and if this should go in r/homeassistant

I'm looking for a cheap, low power device to use as a Tailscale exit node.

Main use case is simple. I want to leave it running 24/7 at home and route traffic through it when I'm outside. I don't need anything powerful, just something stable and not too power hungry.

I'm okay with Linux or OpenWrt. What are you using for this kind of setup?

I have noticed an inconsistency between what you can put in the JSON editor vs what you can do in the GUI version of the Access Controls console area.

If I share a device with an external user, then go to access controls, I cannot add that user to a group through the GUI. It cannot find the user (it only shows users that have been added to the Tailnet).

BUT, if I go into the JSON editor version of the Access Controls, I can put that user into a group just fine, and the JSON saves and validates without issue.

Presumably the devs want feature parity between the GUI and the JSON editor, so this nuance should be addressed.