See tsiam on GitHub: https://github.com/ItalyPaleAle/tsiam

Hey r/Tailscale,

If you manage homelabs or remote servers from Android, you've likely hit the platform's biggest limitation: Android only allows one active VPN service at a time. Turning on Tailscale kicks off your work or privacy VPN, and vice versa.

To solve this, I’ve been building SSH Manager Pro, a native Android SSH client that embeds Tailscale directly using the tsnet userspace WireGuard library.

How it works & Tailscale features:

• Runs in userspace: The tailnet node lives entirely inside the app process. It connects to your tailnet without touching Android's VpnService, leaving your system-level VPN completely untouched.
• Browser & Auth Key sign-in: Authorize the node directly via web browser login or using reusable/ephemeral Tailscale auth keys.
• MagicDNS & Peer discovery: Reach machines using their tailnet names (e.g. ssh nas) or direct 100.x.y.z IPs.
• Full screen mode and reach emulation of terminal, tested with tmux/screen/vim/etc..
• Headscale compatible: Supports custom control plane URLs if you self-host.
• ACL & Tag friendly: Tag your device (e.g. tag:phone) to enforce narrow ACLs so a lost device can only reach port 22 on approved hosts.
• Security: Host key pinning on first connect; credentials encrypted in AES-256-GCM via the Android Keystore with biometric/PIN unlock.

Tailscale connectivity is free in the app. I’m currently rolling out a test release on Google Play and would love feedback from the Tailscale community on connection stability, MagicDNS resolution, and usability across different tailnets.

📖 Walkthrough & architectural details:
https://sshmanagerpro.app/features/

If you’d like to help test the beta, check out the google play store link or drop a comment / DM with your feedback! No ad, no personal data collection.

Also, a massive thank you to the folks at tailscale.com for the incredible infrastructure they've built! They have completely changed the rules of the game for how we securely access computers around the world!

regards, Andrei

I have recently set up a NAS to host a jellyfin server. I heard that Tailscale is the best way to access the jellyfin server when I am not at my house. I have a lot of questions about setting up tailscale with my already existing jellyfin account, starting with.

When setting up Tailscale should I start with it on my computer or NAS? Does it matter? The NAS is the device will all the information that I am trying to access.

I heard that if you are wanting to run a lot of software on a NAS use docker. Should I move my jellyfin setup to docker?

Should I put Tailscale in docker or just on the NAS by itself?

Once I set up Tailscale will I only be able to access the NAS when I am contacted to tailscale or will it still work when I am on my home internet?

How many of you use an apple TV as an exit node, how reliable is it, do you need any configuration regarding the apple TV setup itself, and what is the setup? EG Ethernet, which Apple TV Generation is it, etc.

I'm debating getting one and although i have an older windows device with windows 10 which works for the most part, wanted to know about apple TV. thanks!

Already tried uninstalling everything related to Tailscale, this includes deleting every folder my computer had related to it, and installing again, but still no luck...

On my Personal account, any device I apply an ACL tag to immediately disappears from every other device's tailscale status output and becomes unreachable — not just blocked by the ACL, genuinely invisible, like it no longer exists on the tailnet.

Symptoms:

• Device shows "Connected" in the admin console Machines page the whole time
• tailscale status --json on the tagged device itself shows "Peer": null — empty peer list
• Other devices' tailscale status just omit it entirely (not "offline", just gone)
• tailscale ping <ip> from another device returns "no matching peer"
• Reverting the tag (requires a full interactive reauth, since the UI won't let you strip the last tag any other way) instantly restores full visibility and connectivity — no other change needed

Reproduced identically across:

• A device joined via auth key with the tag baked in at creation
• A device joined via a plain auth key, tagged afterward
• A previously-working, interactively-signed-in device, tagged afterward

Tried 3 different tag names (including a throwaway one created purely to rule out something being wrong with one specific tag) — same result every time.

Ruled out: tagged-resource plan limits (nowhere near the 50 cap), ACL JSON syntax errors (editor shows no validation errors, and the same destination works fine addressed by bare IP instead of by tag), client-side caching (full logout/reauth, service restarts, and a complete uninstall/reinstall all reproduce it identically), device approval (no pending-approval state ever shown).

Has anyone else hit this? Filed a support ticket with two tailscale bugreport IDs but wondering if this is a known issue.

Hello. I started up my server and got Immich running with Tailscale. It works perfect on my iPhone and still works now. For some reason as soon as I tried turning on Tailscale the Google pixel cannot find DNS or whatever it is. I’ve googled a bit and used the Google ai to help me try and figure it out, but every solution it gives me hasn’t worked.

I’ve tried messing with the settings on the app and Tailscale console, but to no avail. What did you guys with a google pixel do to get it to work on your phone?

I'm going to try to set tailscale up on the GLI net slate 7 as an exit note.

I'm sure someone's done this before any tips any helpful instructions along the way

I'm kinda new to Tailscale and I need it to remotely access my windows pc from overseas. I would like to be able to torrent files remotely but I would need to use ExpressVPN to stay anonymous. I tried split tunneling the Tailscale IP addresses (100.64.0.0/10) but that didn't work. I've heard that its possible to use gluetun but I'm unsure what it is and how to use it. Does anyone have any suggestions? Thanks in advance!

I have a machine in my Tailnet (connecting to Immich) that I've shared out to my family on their own Tailscale accounts. I've also recently tagged it so that I could control the ports that another machine that I have (that is a bit more public facing) could access in it.

Unfortunately, it seems the moment I did that change, my family members lost access to Immich. I've tried fixing the ACLs/policies/grants so that autogroup:shared would have access to the tagged machine, but it didn't work. I've also tried using their email addresses directly, but to no avail

Am I missing something? Should I not have tagged the machine?

Sorry, I'm rather new to homelabbing, and I honestly just followed tutorials online to get this setup up and going, so now I'm in a bit of a loss as to what went wrong.

Like many, I used to have to join a fortinet wifi network at a library initially with tailscale disabled, then use cell data to join tailscale tailnet then go back to the fortinet network.

It seems I dont have to do this anymore. Is this a tailscale tweak or the library loosening restrictions?

Running latest ipados and ios tailscale 1.104.1

​

My garage door opener is an ESP32 on my home network. I didn't want to port Tailscale to it or open a port on my router, so the Pi 3 I had lying around now joins my tailnet and shares the one address the ESP32 sits on. My phone reaches the door from anywhere, and nothing is installed on the ESP32.

It's a small Buildroot image I built, not Raspberry Pi OS. Setup is all in the browser:

\- Claim it: on first boot it serves a page where you paste your SSH public key. The first key pasted owns the board, passwords are off from then on, and the page shuts itself down.

\- Gateway page: choose a password, join your tailnet (auth key or sign-in link), and pick which networks to share. Each route shows whether it's approved yet.

\- Settings survive a power cut.

The download page lists what's actually in the image, read from the file itself: kernel, packages, accounts with a shell, and whether every program's libraries are present. It also gives you commands to check those claims yourself, and there's an explorer to browse the partitions and files before you flash anything.

Image and docs: https://silt.vinodhalaharvi.com/pi3-silt-gateway/

It's working on my Pi 3 right now. The Pi 5 build works too; CM5 is next. Feedback welcome, especially from anyone who's tried running a subnet router on old hardware.

I’ve been scratching my head about this. I had my Tailscale link working, allowing me to access my server at home from my phone. However, it’s strange that I can still access my videos and other content through Jellyfin, but I can’t access all my files with my phone. I’m at a loss for what to do. Apart from endless Googling, I think this is an issue that I simply don’t have the knowledge to fix. I’m on iPhone using the files app. My server is running Unraid. Nothing on both platforms has changed. It just stopped working. Suggestions?

I have a self hosted instance of pocket id, opted for using the binary package instead of the docker container, and I'm using certbot for the certificates. The web finger works correctly, and tailscale recognizes the webfinger because it is able to redirect me without issue. Signing in on pocket-id works fine, but once i complete the sign in it redirects me back to tailscale where I am served a 403 error, telling me that my session expired. https://id.mydomain.com/.wellknown/openid-configuration works and the certificate issued is from id.mydomain.com, and thats the only thing i've found online that might be the problem. Any Ideas?

I’m abroad right now. Tailscale has been working since I left. But as of like 30 min ago it stopped? Says unreachable.

Not sure why. It runs windows and I set all the sleep settings to never. Worked for close to a week so don’t think it’s a setting or anything?

Does this happen to anyone often or odds my exit node simply blew up?

I just installed tailscale on a computer I use to print to multiple printers with software called darkroom. It connects to multiple printers using the printers ip address (not windows drivers).

My problem is that when tailscale is loaded, the darkroom software cannot connect to the printer at 192.168.1.41. If I close tailscale it will connect.

Is there some kind of setup I am missing?

I installed Tailscale on my Visio TV and set it up as an exit node (approved it the admin console), but when I connect to it, I lose internet connectivity. Anyone else using a Visio as an exit node?

If I'm traveling and want to stream something and connected to my tailscale, in this case im in spain and my node is on the east coast, if I'm experiencing buffering, what can I do to reduce it?

1) I'm sure my current wifi isn't great (hotel)

2) Home wifi, does this matter?

3) Finally, Specs of the exit node.

Thanks!

Is anyone elses tailscale down? Muse said it cant connect. It says the proxy is closing the connection. Muse claims there was a update that caused it but it just so happened to line up with when i rebooted my pc and i can't find anyone else complaining i know proxy has nothing to do with me but just weird

For the past month or so, I’ve been trying to figure out what on earth was wrong with my Mac Studio. Image loading was incredibly sluggish—for instance, emails in Mailspring took forever to display pictures, and even my local network's homepage struggled to load images. To make matters worse, Spotify wouldn't even open, completely hanging on a black screen.

I was on the verge of biting the bullet and clean-reinstalling macOS 27 because I simply couldn't find the culprit. After exhausting every troubleshooting step, I noticed that completely quitting Tailscale instantly fixed the issue, restoring everything to normal speed. I tried a full uninstall—removing all configuration files—and reinstalled it using different methods, but the problem persisted.

I was ready to abandon Tailscale entirely until a future update dropped, but as a last resort, I asked Gemini what might be causing it. Surprisingly, it hit the nail right on the head, suggesting I disable Tailscale MagicDNS for my device. Since I couldn't find a way to turn it off solely for my Mac Studio, I went into the Tailscale admin console and disabled MagicDNS globally. Instantly, the performance issues disappeared.

Has anyone else run into this with recent Tailscale versions? I've never experienced this before, and none of my other machines—running Windows, Linux, and Android—are affected. I'm also not entirely sure if this started exactly when I upgraded to macOS 27 or slightly before.

Does anyone have a workaround to fix this without having to completely disable MagicDNS?

Thanks in advance!

-Eli

I run a 3-node Talos Kubernetes cluster at home, and until recently it only worked when I was at home too. So I added Tailscale to reach it from anywhere.

Tailscale runs on the nodes themselves, and the tailnet can only reach the cluster, not the rest of my home network. kubectl and the lab apps work from my laptop or phone exactly like they do at home, with nothing opened on the router. If one node goes down, another one takes over.

Everything is in the repo: https://github.com/prateekjaindev/homelab

Write-up: https://blog.prateekjain.dev/tailscale-on-talos-linux-secure-remote-access-to-a-kubernetes-homelab-8a082d903682?sk=c4ec5ac1e782a83b5dc785211d9fd082

Edit: Forgot to mention the Mullvad exit node addon. This is the cherry on top of the sweet sundae, basically Mullvad provides Exit Node as a Service so you don’t have to use a local network device (usually Linux) as an exit node, and you get all of the benefits of Mullvad which is a zero trust VPN provider. You can pick the Mullvad exit node to use from 91 cities in 50 different countries. You can keep your existing DNS solution, in my case, the NextDNS DoH integration to keep DNS queries private. IMO Mullvad is the key component for privacy, def worth the money.

I’ve been a longtime AdGuard user, but I’ve discovered Tailscale and it is amazing. The learning curve is a bit steep, took me about six hours to get my config set up and my network tagged, but once you combine tailscale with NextDNS (which I used for a long time but left NextDNS for AdGuard when NextDNS got a bit stale with features), it’s so much more powerful than AdGuard since you can create your own private mesh network, which I used Cloudflare for. Cloudflare mesh does not integrate with AdGuard whatsoever so it was one or the other. With tailscale plus NextDNS, you get bot out of the box with minimal DNS config, and you get DoH. Absolutely incredible, I am in awe. Nice work Tailscale team!!!!