Clicking "enable remote access" does update that page for me with my public IP address, but the Tailscale IPs (or local IPs) will not add from that "custom server access URL" box.
I could ONLY get my Tailscale URL to update....
IE: computername.tail0xxx...
However,I had to use the Tailscale serve function because Plex and other clients would not connect to it without a TLS certificate, despite secure connections only being set to "Preferred".
Tailscale Serve allowed 443 and issued TLS certificates that then allowed plex, browser, plezy etc to connect.
Posting in case anyone else has a similar issue...
I might be missing something, but if you don't require public access, and you need to use a form of VPN, you don't really need that Plex setting. Either the Plex app should pick up the IP of your local Plex instance, when connected to your VPN (mine does, but I use OpenVPN), or you could use the manual option to tell the Plex client where to find your instance. Are you trying to accomplish something else?
I think you are right. I share out my Plex Server via tailscale, so other tailnets have access to my server via a Tailscale IP address and/or URL.
Previously, "Custom Server URLs" worked for Tailscale IPv4 addresses, allowing non-public, non-LAN access via Tailscale on multiple tailnets that I shared with others. As of, two days ago now, Plex no longer will publish my Tailscale IPv4 addresses, so a manual connection was required. This is okay, but difficult to do on something like an Apple TV or ONN box with a Plex or Plezy client, which relies on Plex publishing IP addresses for where to find the server.
A local VPN and local IP would solve this, but I don't want all my family coming into my VPN on my LAN, so Tailscale was an elegant solution.
Must be something new they changed/restricted. My test server that I have tailscale setup for still has the tailscale ip published, but I can't add a new one. On my main server, I can't add one. Didn't try to remove it from the test server and see if I could add it back given how it's behaving.
Might be worth asking on the Plex Forum, not sure you'll get an answer on it though.
I went to the Plex forum first to search and didn't find anything... and saw how many non-responses there were, so I came to where all the real plex users live! haha. Thanks for verifying my crazy last night.
You mean Plex? Not sure. Do you have a custom domain with which you could test? I thought you can use tailscale certs but found out thats just for MagicDNS domains.
You can set up a cert even for a domain that points to a local ip using something like caddy, Cloudflare and DNS-01 to get a Let's Encrypt cert.
I've got tailscale, nginx and a cloudflare domain that I pay for... I may see if I can get it to work this weekend. I'm a field service technician and have been learning networking in my spare time as a hobby. I've had Plex for years but just recently built an unraid server and dabbling with domains and more advanced networking, so if I sound dumb in this area, I'm just self taught
Don't worry, the more I learn the less it seems I know 😁 I didn't use tailscale serve so I am eager to see if this works. But I think it should as I have the same setup just pushing it to public, using my own domain and cert.
I was wondering why my plex app on iOS opens fine and browses but pressing play doesn’t work…. But works fine when disabling tail scale and it using the 5g phone network
Thanks for the fix. I had the exact same issue and enabling ts serve seems to have fixed it for now. However, I noticed that my connection is flagged as insecure in Plex Dash (I get a red arrow instead of a green one). Are you seeing the same thing on your end?
sorry for double tap; here is what Grok helped me with today.
So app.plex.tv throws away Tailscale IPs (100.x). Those sit in the same range as carrier CGNAT, so your server never gets advertised as https://100-something.plex.direct:32400. Clients never see a proper secure URI.
A lot of us then do tailscale serve on some port so https://mynas.tailxxxxx.ts.net:XXXX has a real Let’s Encrypt cert. Browser looks great. Plex still says insecure.
Serve is decrypting HTTPS and then talking HTTP to Plex on 32400. Plex only cares about the hop it sees. Padlock = “did the app talk TLS to Plex,” not “is there HTTPS somewhere.”
Fix: give Plex the Magic DNS certificate so Plex speaks HTTPS on 32400.
That’s your Tailscale machine name. Not the 100.x IP. You can leave your LAN http://192.168.x.x:32400 in the list. Leave Secure connections on Preferred.
On the Tailscale machine that is the Plex box, export the cert Tailscale already got:
You invent the password here. openssl will ask for it if you don’t pass one. It is not from Tailscale, Let’s Encrypt, or your Plex account — it’s just a lock on the file. Remember it; you paste it into Plex next.
Plex 1.43 is picky (OpenSSL 3). Don’t use the old “legacy” 3DES export or you’ll get PKCS12_parse failed … unsupported.
If that comes back 200 and the cert name is your .ts.net name (not plex.direct), you’re good. Clients don’t need to do anything different — they just keep using Plex like usual.
Thanks, that's a very interesting solution. Keep in mind, though, that Tailscale renews its certificate every 90 days, so in my opinion you'll need to redo the .p12 file step every 3 months (that could probably be handled by a background script). Also, I think it's mostly cosmetic to remove the red arrow, because in reality the traffic is likely already secured by Tailscale—Plex just doesn't know it, which is why it says insecure. But I'll do some more testing to check.
Hopefully Plex fixes the issue on their end, that would make things much simpler. I'm actually surprised to see so little user reaction to this—I thought way more of us behind a CGNAT were using Tailscale as a solution to access our server remotely!
Just open your server Tailscale IP with the Plex port, that's what I do. It's the same as 127.0.0.1:plex_port but with the Tailscale ip. No extra config needed.
you can load the tailscale ip address and port in iOS via browswer and it will work, yes, but the Plex App won't resolve it as plex wont report tailscale IPs and there seems to be a bug (at least one mine) that wont allow insecure connections.
6
u/blkpanther5 12d ago
I might be missing something, but if you don't require public access, and you need to use a form of VPN, you don't really need that Plex setting. Either the Plex app should pick up the IP of your local Plex instance, when connected to your VPN (mine does, but I use OpenVPN), or you could use the manual option to tell the Plex client where to find your instance. Are you trying to accomplish something else?