Disclaimer: I’m currently on a static IP and run Plex using a lifetime Plex Pass, with remote access enabled. That said, I still understand the frustrations that come with CGNAT setups.
With the lack of IP address for IPv4 and the introduction of ISP CGNAT, this has created chaos with self hosting and using Plex.
Clouflare tunnels is good, but it’s also against their ToS for media streaming and download servers which you could find yourself without access. It’s currently not explictly against Tailscale ToS yet, but it’s not the recommended use for the funnel service.
Tailscale funnels to save the day! (..for now)
Essentially this opens up a service to the tailscale domain (.ts.net) which are public facing, this will ‘funnel’ all traffic into your deisgnated service when accessed.
First you’ll need to create an account with tailscale if you havent already.
Head over to the Admin Console and DNS
Hit the ‘Rename tailnet…” button until you get something cool 😉
My example shows cool-kid.ts.net
Scroll down and make sure MagicDNS and HTTPS Certificates are active
Install Tailscale on your VM or LXC, instructions can be found here.
Alternatively, use this script
curl -fsSL https://tailscale.com/install.sh | sh
If installing on an LXC you will need to add a few extra commands to the config in proxmox.
nano /etc/pve/lxc/<CTID>.conflxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
Restart the LXC when the changes have been made.
For both VM and LXC now activate tailscale with:
tailscale up
Follow the link to authenticate tailscale, this should now show up in your admin console.
While still in VM / LXC shell we use the magic command to allow the funnel!
tailscale funnel --bg http://127.0.0.1:32400
Follow the instructions to accept the Funnel and keep both boxes ticked
Pay attention to the output of the command, it should look something like this
Available on the internet:
https://plex.cool-kid.ts.net/
|-- proxy http://127.0.0.1:32400
Funnel started and running in the background.
To disable the proxy, run: tailscale funnel --https=443 off
Make note of the webaddress as we will need to enter this into plex settings.
Navigate to your plex instance settings http://<YourIP>:32400/web and scroll down to Remote Access and click Disable Remote Access as this wont be needed anymore.
Navigate to Network and scroll down to the bottom, enter in the webaddress tailscale gave you in the output from the funnel command, you must include the :443 port at end for this to work.
https://plex.cool-kid.ts.net:443
Then hit save changes, and restart Plex for good measure.
Now your plex server will be accessible behind CGNAT with Tailscale Funnels.
The only downside – when looking at your dashboard, remote connections will not show on the graph.
If you also want to continue using tailscale for secure access to all your selfhosted apps, they offer a feature called Split DNS by domain. Which when connected to tailscale allows you to route all dns requests for your personal domain like richay.au into your PiHole / Adguard instance to redirect you to your internal reverse proxy. This stops unwanted access publicly to self-hosted services, but allows devices signed into tailscale to have access. My guide can be found here.
For public facing services like this blog, cloudflare tunnels is a great way to get around CGNAT.
Enjoy 🙂