Disclaimer: I’m currently on a static IP and run Plex using a lifetime Plex Pass, with remote access enabled. That said, I still understand the frustrations that come with CGNAT setups.
With the lack of IP address for IPv4 and the introduction of ISP CGNAT, this has created chaos with self hosting and using Plex.
Clouflare tunnels is good, but it’s also against their ToS for media streaming and download servers which you could find yourself without access. It’s currently not explictly against Tailscale ToS yet, but it’s not the recommended use for the funnel service.
Tailscale funnels to save the day! (..for now)
Essentially this opens up a service to the tailscale domain (.ts.net) which are public facing, this will ‘funnel’ all traffic into your deisgnated service when accessed.
First you’ll need to create an account with tailscale if you havent already.
Head over to the Admin Console and DNS
Hit the ‘Rename tailnet…” button until you get something cool 😉
My example shows cool-kid.ts.net
Scroll down and make sure MagicDNS and HTTPS Certificates are active
Install Tailscale on your VM or LXC, instructions can be found here.
Alternatively, use this script
curl -fsSL https://tailscale.com/install.sh | sh
If installing on an LXC you will need to add a few extra commands to the config in proxmox.
nano /etc/pve/lxc/<CTID>.conflxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
Restart the LXC when the changes have been made.
For both VM and LXC now activate tailscale with:
tailscale up
Follow the link to authenticate tailscale, this should now show up in your admin console.
While still in VM / LXC shell we use the magic command to allow the funnel!
tailscale funnel --bg http://127.0.0.1:32400
Follow the instructions to accept the Funnel and keep both boxes ticked
Pay attention to the output of the command, it should look something like this
Available on the internet:
https://plex.cool-kid.ts.net/
|-- proxy http://127.0.0.1:32400
Funnel started and running in the background.
To disable the proxy, run: tailscale funnel --https=443 off
Make note of the webaddress as we will need to enter this into plex settings.
Navigate to your plex instance settings http://<YourIP>:32400/web and scroll down to Remote Access and click Disable Remote Access as this wont be needed anymore.
Navigate to Network and scroll down to the bottom, enter in the webaddress tailscale gave you in the output from the funnel command, you must include the :443 port at end for this to work.
https://plex.cool-kid.ts.net:443
Then hit save changes, and restart Plex for good measure.
Now your plex server will be accessible behind CGNAT with Tailscale Funnels.
The only downside – when looking at your dashboard, remote connections will not show on the graph.
If you also want to continue using tailscale for secure access to all your selfhosted apps, they offer a feature called Split DNS by domain. Which when connected to tailscale allows you to route all dns requests for your personal domain like richay.au into your PiHole / Adguard instance to redirect you to your internal reverse proxy. This stops unwanted access publicly to self-hosted services, but allows devices signed into tailscale to have access. My guide can be found here.
For public facing services like this blog, cloudflare tunnels is a great way to get around CGNAT.
Enjoy 🙂
This is useful. I can get this working only if I log into Plex from my client using a web browser. However, if I use the Plex Android App, it doesn’t seem to work. Does the Plex app work for you. Any ideas?
My phone app does work – tested without being signed into tailscale and using cellular data. Possibly sign out and sign in on the app? and ensure that the network settings in plex are correct through the web access settings with the port number added. eg, Custom server access URLs: https://plex..ts.net:443 then it should relay all plex requests through tailscale into your local plex. If you’re still having troubles, let me know and i’ll add you to discord to try help you out 🙂
Thank you! I really needed this guide to get out from behind CGNAT in Germany.
I have vodafone modem, my own router, and tested this on iOS, web browser, and Google TV device.
This was so helpful.
Thank you!
Just wanted to drop a thankyou, I was having issues getting my tailscale funnel working on a windows based OS (server 2022) and was following another helpful guide on reddit. Combining their knowledge and yours I got it working. The :443 was the missing link for me to get it working at the end of my custom server access URL. Really appreciate the guide!
Glad I could help bud 🙂
don’t want to get in trouble with tailscale since funnels go through them and bandwidth is expensive. i got a vps from a provider on lowendboxes for $11/yr, some minor setup to make it more secure then installed tailscale on it and my server at home then pointed the domain i owned before cgnat to to the vps and had caddy redirect the subdomains to the tailscale ip of my home unraid server. you have to have a domain which you can probably find for free if you don’t want it overly simple and a vps.
Hi, it kind of works since when I open that tailscale url it opens plex on my phone, but it asks me to pay for plex subscription on both the app and the web (in my phone).
My discord is s4bishi. if you know any solutions, thanks.
Hey mate, added you on Discord.
Is it just you using Plex away from home? If so, the simplest option is to install Tailscale directly on the Plex host and then access Plex from a device logged into Tailscale. From Plex’s point of view, everything appears to be on the same local network.
If you can’t install Tailscale on the Plex host, you can instead use Tailscale subnet routes. That lets you access Plex via its local IP from anywhere, as long as the client device is connected to Tailscale.
In both cases, the Plex stream itself runs through the Tailscale tunnel (usually peer-to-peer using your own bandwidth), rather than just using Tailscale for initial connection setup.
Thank you – this saved a life!