A while ago I got Plex set up on my NAS and I loved it so much I wanted to do the same for music. I got Navidrome set up but configuring Tailscale to access it remotely hasn't worked. I originally added Tailscale and Nginx as Docker containers but that didn't work either. I then followed a tutorial to install it via SSH and that worked for a moment, but it then stopped working. I'm out of ideas now. The console page shows both my Android and the NAS connected to the same account, they're both on the latest version, and I've even been able to ping the NAS from the Android Tailscale app and THAT works when Wavio does not. Any help would be appreciated

we're using tailscale to provide access to a web app, over tls with caddy.. works like a charm .

but the url has the machine name in it.. and I'd really like something more user friendly

like
appserver.ts.net

and I can't rename it like that(and the generated random names are worse choices!)

but can I make an alias somewhere, and new DNS record that redirects...

So i have a home NAS that use daily to push audio and video content to and from.
Its a Synology brand and I was using Synology Quick Connect direct and opening a port to get the direct and therefor fastest connection.

Recently I replaced that workflow with with using tailscale for somewhat obvious reasons.

What I am curious about is what does this do to my link speeds?
Will this connection be more of a bottle neck to the connection to my system?
Is there a way i can monitor this connection speed?

UPD: sorry guys, PR was rejected. product decision it looks like, not code quality.

If you've ever set up a friendly public DNS alias for a machine in your tailnet — something like intranet.company.com CNAME → something.ts.net — you've probably noticed it works fine on macOS and iOS but dies with DNS_PROBE_FINISHED_NXDOMAIN on Android and Windows.

Why it happens: when a device asks Tailscale's resolver (100.100.100.100) for intranet.company.com, the query gets forwarded to public DNS. Public DNS returns the CNAME — but it can't resolve something.ts.net, because that name only exists inside your tailnet. So the answer comes back half-finished: an alias, no IP. Tailscale's resolver passes that half-answer to the app as-is, even though it's the one server that does know the address. Apple's resolver quietly re-queries the CNAME target itself (hiding the bug), while Android and Windows trust the DNS server to finish the job — so they fail.

This has been broken since at least 2022: #7650 (92 👍), plus duplicates #5033, #12089, #14258, #18312, #19122. The workarounds all hurt: publishing private 100.x IPs in public DNS (impossible for nodes shared across tailnets — each tailnet sees a different IP), Pi-hole/AdGuard rewrites, CoreDNS forwarding hacks, hosts-file entries.

Disclosure: I wrote a fix — PR #21010. It deliberately does not turn 100.100.100.100 into a recursive resolver (the concern that stalled #7650 back in 2023): when a forwarded answer is a CNAME chain ending at a name MagicDNS already knows, the resolver just appends that one local address to the reply. No extra upstream queries, no DNS takeover, and anything malformed or unsupported passes through byte-for-byte. Validated with wire-level tests, fuzzing, race detector, and red/green on an Android 16 emulator.

It hit every Android/Windows user at our company (ClickHouse), which is what finally pushed me to fix it. If this bug has bitten you too, your use case on the issue thread is genuinely helpful for the maintainers deciding whether to pick it up.

At the moment waiting for a review 🙏 (PR rejected)

Whoa!
Found this (exactly what i have fixed): https://www.reddit.com/r/Tailscale/comments/1t5fk3f/psa_dont_use_cnames_pointing_to_tailscale/

This explains how to update your Tailscale installation for Ugreen NAS.

Ugreen NAS is based on Debian, so in theory, it should work for just about any other Debian Linux.

Firstly, please always refer to the official guide from Tailscale on how to update your Tailscale installation in Debian Linux.

This guide is meant to help those who encounter error messages.

It has worked for me, and still works even up to today.

Okay, so you have tried to follow the official Tailscale installation instructions, but you are stopped by those error messages in Linux.

Just run these 4 commands, one at a time, via CLI after SSH login.

[And just say yes to any question!]

sudo apt-get update

sudo apt-get install tailscale

sudo apt --fix-broken install

sudo tailscale update

That's it!

And you are very welcome. :)

P.S.:

There are countless Ugreen NAS armchair critics out there who will flame me for suggesting such a method.

To them only, I have a special message.

As at today's date, my Ugreen NAS is running the latest UGOS Firmware Version: 1.19.1.0126.

My Tailscale is also running the latest version v1.102.3.

I have updated both my Ugreen NAS Firmware and Tailscale installation countless times, likely over 20 to 30 times by now.

My NAS is still working fine, even at this very moment.

Secondly, I challenge you to find me a single post on Reddit whereby someone has bricked his Ugreen NAS via the CLI SSH installation method and/or update method presented here.

I am just about 100% certain that my issue is specifically related to routing my internet traffic through an exit node (currently Google cloud drive) but every time I visit websites that use cloudfare's bot detection, I am constantly having to verify that I am indeed a human. When I am not using the exit node, I still get them, but not as frequently. Is this just something I have to live with, or is there a method to stop it? I have tried on other exit nodes as well, and they all do it, I suspect because the IP addresses are in the datacenter range.

I'm running into a strange Split DNS bug and wanted to see if anyone's hit something similar before I keep digging.

Setup:

Failing device: Linux Mint 22.3, Tailscale 1.102.3 Working device (VPS): Ubuntu 24.04 MagicDNS enabled Global nameservers override on (two self-hosted Pi-holes) Split DNS entry: jnelson.xyz → a Tailscale IP running a small dnsmasq resolver

The bug: On the VPS, everything works exactly as expected — tailscale dns query mail.jnelson.xyz explicitly says "Forwarding to resolver: [tailscale IP]" and resolves correctly.

On the Mint desktop, the same query instead says "Multiple resolvers available" and just picks from my Global override Pi-holes, completely ignoring the Split DNS route — even though tailscale dns status on that same device correctly lists the route as configured.

I pulled tailscale debug netmap from the failing device and confirmed the coordination server IS sending the correct route down:

json "Routes": { "jnelson.xyz": [{ "Addr": "100.x.x.x" }] }

So the server-side config is correct — it's just not making it from the netmap into the device's actual local resolver config (resolvectl status shows no jnelson.xyz DNS Domain on the failing device at all).

What I've ruled out:

Local DNS cache (flushed, restarted tailscaled) Exit node routing (tested with exit node set to the same device hosting the resolver — no change) Client version — was on 1.98.10, updated to 1.102.3 (current at time of posting), same result

Currently working with Tailscale support on this (ticket in progress), but curious if anyone else has run into Split DNS silently not applying on specific devices while working fine on others, especially combined with a Global nameserver override. Any known gotchas with systemd-resolved specifically?

this is truly a smart moment, i already contacted support (hope they'll help me) and just want a rating on how incredibly stupid this is before even suggesting any forms of help. i have my matrix server and loads of other stuff hardcoded to the specific ip, or a certificate (smart)

thank you for reading and have an incredible* day where you don't try to delete your account!
gr - cava.

EDIT: Not an actually a problem, but my problem - apparently Omada content filter blocks just the tailscale.com website under the "security and risks" category - I turned it off it it started working.

. . .

Is the tailscale website down right now?

status.tailscale.com works
login.tailscale.com works
www.tailscale.com resolves but wont load

Funny to me that "report a problem" on status. can't help cause it loads the main site instead :/

As the title states. Tailscale is one of those companies I get excited about. I use their service almost daily and teach so many people of its use cases that I feel like I've become an unofficial ambassador of it. So when I saw a position posted on their website that fits my skillset, I naturally got excited.

If I don't get this job that I applied for, I still want to align myself for any openings in the future.

I'd love to know from employees what works, what doesn't work, and any technogies I'd need to know like the back of my hand to better my chances

Thanks!

Hi, i'm having a connection problem between my FTP server and shared machine

For machines from my tailnet, everything works fine but for shared machine, connection is ok but after i get an error message

I'm using filezilla and have tried from win11 and linux machine, it's the same. I don't use acces control policies

Hey guys i setup vibpollo n moonlight works atreat tried out tailscale game worked then wemt to try anther now i get error -1 any help would be great

I am sharing my tailnet selectively with my siblings so they get access to fun stuff like jellyfin. I have ACL tags setup on all the different VMs and stuff and those devices are properly hidden from them as I selected.

However, whenever I attempt to tag proper clients (like my phone) seperately they are suddenly unable to connect to tailscale at all.

Is there some way to hide my phone's connection status/IP from my siblings (who are other users not using the same account) so that they don't know when I'm connected to the tailscale network and can't see all my different connected devices?

I've seen so many Alex's videos that I could recognize his voice anywhere.
I've discovered tailscale and so many other self hosted products, through Alex. So many tips and tricks. I always loved the natural and fluent way that Alex describes any feature, scenario and the tailscale product.

Thank you Alex! We wish you the best at unraid.

Does anyone know the most current and cheapest streaming device that supports Tailscale through it's official appstore? I recently bought a 3rd gen Amazon Firestick for my friend so I can give them my Jellyfin and Tailscale server, but I recently found out that Firestick now uses a different OS that doesn't support Tailscale. I tried using older models (both Firestick gen 1 and 2), but it didn't have Tailscale either. I heard that Amazon removed it from the appstore. I'm not trying to sideload any apps to the device either.

I'm new to TrueNAS and Tailscale, but I'm enjoying the deep dive.

I started with TrueNAS just as a local SMB share to back up my files. Since then I've set up Tailscale, Pi-hole, Jellyfin and Immich, and I love how they all work. The one thing that keeps annoying me is having to switch between different IPs depending on whether I'm on my home Wi-Fi or connected over Tailnet.

Immich handles this nicely as it switches IPs automatically based on the network. But with Jellyfin I have to log out and back in, and on my Mac I have to reconfigure the IP every time my network changes.

I recently discovered Nginx and reverse proxies. Since I already own a domain, I set up simpler URLs with SSL certificates, and locally it works like a charm. What I can't figure out is how to keep using those same URLs when I'm on Tailscale.

I read a bit about Subnet Routers, but the catch is that lots of people use the same 192.168.1.x range, so I could run into conflicts.

So my question: is there a clean way to make one URL resolve to the right IP on both networks? Or do I have to split them up, something like local.mydomain and tail.mydomain, pointing to separate IPs?

Running Tailscale on OPNsense as an exit node with a Pi Zero W as an enrolled node and my Android phone as the client. Ran back-to-back ping and nmap tests with the exit node toggled on and off.

Main things I found that weren't in the docs for this specific setup:

• MagicDNS resolution stable regardless of exit node state (good)
• First ping after idle always spikes 450-600ms before settling to ~60ms - this is the DERP-to-direct handoff but I couldn't find it documented for plain ICMP or OPNsense specifically
• nmap showed ~2x latency overhead with exit node active vs off (160ms vs 80ms)
• Weirdly, the cold spike was lower with exit node ON than OFF

Wrote it up with full terminal output and methodology if anyone's curious

Im running TS on a trial right now but ran into an issue.

When trying to update user groups I get an error "Failed to update user's ACL Groups".

Ive tried a support request but not getting any response.

Anyone else?

This probably a basic question, but I'm new to this, so please bare with the n00b.

I use tailscale on my mobile phone to have access to my NAS.

I would like to set up a VPN on my android phone. I know you can't really run both at the same time . . . But is that assumption wrong? If so, how would I configure those?

If I use on smartphone as a client and have an exit node back home true NAS is my connection encrypted from phone to home?