Master Tailscale pt 3 - Beat Carrier Grade NAT with Tailscale, Swag, and a VPS

[@39zack]

TimeStamps: 0:07: Listen! 0:10: Intro 0:33: What is CGNAT? Why the need of an VPS? 1:40: VPS cost and specs needed 2:15: Where to get an VPS and its location? 4:50: Installing Ubuntu on the VPS 5:20: How to SSH into the server 5:50: But first we need to open some ports 8:25: Back to logging in over SSH 8:50: Update Ubuntu 9:10: Install first set of packages and docker 9:49: Set Docker to start with the server 10:00: Installing Portainer 10:40: How to access portainer 10:55: Installing Tailscale on the server 12:00: Setting up Portainer 12:37: Setup LinuxserverIO templates and installing SWAG on Portainer 16:16: Setup of the SWAG proxy config, featuring Jellyfin 20:22: Setup DNS in Cloudflare to point to the VPS 21:00: Testing Jellyfin 22:11: End, thanks for watching!

[@SpaceinvaderOne]

thanks :) posted this into th description

[@39zack]

@@SpaceinvaderOne 😁

[@weholmes5315]

Recently watched parts 1 & 2 and was looking for part 3 earlier today and here you are. Much appreciated! 😊

[@SpaceinvaderOne]

You are very welcome :)

[@videowatcher495]

Unrelated to this video, I would LOVE to see a setup guide for the Netbootxyz docker especially for windows and local ISOs. Thank you for all of your hard work. I know making these videos is not easy and takes a lot of time. Your talents and time are greatly appreciated by the Unraid community.

[@glepa]

technotim has done a video on netbootzyz, kzbin.info/www/bejne/apPXiGiulMifpsk but that ofc dont show what you do on unraid. So maybe there is an video idea on how to do it unraid version 🙂

[@andresquintero5266]

Thanks for the series, greetings from Colombia

[@Ajicles]

You can also get an Oracle Free Tier ARM based VPS. It has 4vCPU, 24GB of Memory, 50GB SSD, 4Gbps Network Access and 18TB of Bandwidth.

[@MrPrabha]

I'm currently using this setup for my Tailscale tunneling

[@drmetroyt]

​@@MrPrabhawill Oracle ask for money later ? Or is it free always?

[@MrPrabha]

@@drmetroyt You need to use the given free resources, if u go with 4vCPU, 24GB of Memory, 50GB SSD, 4Gbps Network Access and 18TB of Bandwidth its free

[@2ASupp0rter]

@spceinvader one , great 3 part series (my favorite so far). Would you be doing something similar for Twingate in the near future?

[@sarf9069]

Great vid as usual! Would love to see a video on how to port map back to an unraid gaming VM using tailscale in order to publish said gaming server to the internet over CGNAT. I managed to do it using ubuntu on a VPS and iptables but there maybe a better more secure way with some form of DDOS protection!

[@No07One]

finally, thank you

[@SpaceinvaderOne]

Thanks for your patience, I hope you find it useful :)

[@MrLFSilva]

Great video as always. Is it possible to configure this without a domain?

[@MrSchuu]

Thank you for the video, would this method work for game servers? with some changes of course.

[@dlmac]

I had issues pasting the commands from the Google Drive document he shared. It has double spacing, so you will need to paste into notepad and remove them.

[@saneparadox8181]

i'm curious, i was able to create a reverse proxy for my unraid server at home while using the method in the previous video. How does that work and differ from this method? Does this work only because my network isn't behind a cgnat?

[@AniviaS]

Yes

[@leonardocarvalho4944]

Greetings from Brazil! Thank you for this great video! I followed all the steps to setup Plex but I only get toi the welcome page of SWAG. What did I miss?

[@SpaceinvaderOne]

Hi if you are getting to the welcome page you are reaching swag. But it hasn't loaded the config file for the app/ subdomain you are accessing. in the video you see me edit it and add the tailscale ip of the unraid server. Make sure you saved it as .conf and not .sample and also you rebooted swag after for it to reload the config. other thing it may be is the subdomain name you are using . in the config you will see a line such as. server_name jellyfin.*; that would work for the subdomain jellyfin.yourdomain.com however if you made a subdomain video.yourdomain.com you would need to change the line in the proxy config file to. server_name video.*; I hope that helps

[@chrysenxciii7102]

Thank you for your very useful videos, there is one thing I am still missing. How to create normal port forwarding with tailscale without swag etc. So a Minecraft server for example. Currently I do this directly via wireguard and iptables. With tailscale the administration might be a bit easier.

[@Elmojomo]

The commands in the Google Drive doc don't seem to be work correctly, Ed. Even if I remove the line breaks, I get errors. For example, after adding the repo, and trying to run sudo apt update, it throws: E: Malformed entry 1 in list file /etc/apt/sources.list.d/docker.list (Component) E: The list of sources could not be read. Any ideas? EDIT: Yeah, I just went back, cleared the repos, and tried it all again from scratch, with the same result. It errors out when I get to the step of trying to update after adding the Docker repo. I'm on Ubuntu 22.04, if you think that makes any difference. I'm really hoping to get this working, since I've been waiting for MONTHS to see if this solution can get me around my CGNAT issues.

[@dlmac]

same issue. any luck? edit: I pasted the string into notepad and removed the spaces into one line. ran the command again and it worked.

[@elvemoon]

Could you use the local IP address of your machine on the VPS if you enabled the "Subnet Routers" function on Tailscale?

[@SpaceinvaderOne]

Well yes probably. But I wouldnt personally. Why? Well you dont know what the local ip would be on the vps? There is a chance it could be the same subnet as your home local LAN. Also using the subnet routing is another layer of translation to go through. I suggest just use the direct tailscale ip of where the service is running.

[@i_clixx4700]

hi, is there any way I can reverse proxy into the VPS portainer without using tailnet, thanks

[@jonjohnson2844]

As someone who is completely lost when it comes to DNS, I friggin love Tailscale...I've stopped caring about how everything works, it just does.

[@IanMcLeish]

would emby work the same way by editing the correct conf file?

[@B4I34]

So with this setup I do not too have to be in the tailscale network to access those containers? E.g. when I connect to my Nextcloud I can share a file to others. Is this correct?

[@SpaceinvaderOne]

Yes nextcloud will work as normal. No one connecting would need to use tailcale. Tailscale is just joining the vps with the reverse proxy to your server at home behind the carrier grade nat. The subdomain you use eg nextclou.yourdomain.com is publicly accessible

[@i_clixx4700]

hi, thank you for the 3 video i am looking for something to backup my wedding video and phots offsite to my friend unraid though nextcloud i have tried everything, the big file size fail to upload will this work any help and advise much apperciated.

[@SpaceinvaderOne]

A few ways. You could use something like Syncthing or Resilio Sync to sync a share with your friend, you will not have any issue then with large files.

[@i_clixx4700]

@@SpaceinvaderOne thank you for your reply and if someone wants to upload to our server who does not have unraid what are the option, thanks indy

[@SpaceinvaderOne]

@@i_clixx4700 If its just photos etc then immesh is very good. You are using nextcloud but seafile is another option too

[@Apollopayne25]

Ionos do a 1 core, 1GB RAM and 10gb storage with unlimited bandwidth for £1 a month in UK. Would this be enough?

[@SpaceinvaderOne]

Um for light traffic maybe but is pushing it with the ram to be honest. Give it a try and see how it goes, but you may find you might need to up it to 2gb

[@CivilSphere]

Why do you need swag and VPS? Doesnt Tailscale alone establish that connection?

[@SpaceinvaderOne]

This is for using a domain. So for example if you had nextcloud. nextcloud.yourdomain.com by using this method it makes that domain publicly accessible (people connecting not needing tailscale. .... but if your server is not behind carrier grade nat too can just use a reverse proxy locally, this is just for those who dont have a public ip on their ISp

[@perrytaylor8240]

You need something to bridge from the public internet to your tailscale network.

[@CivilSphere]

@@perrytaylor8240 But currently with just Tailscale I can access Plex just fine... So why would I need Swag and VPS?

[@mg3299]

Will this method work for client Plex app (not browser)?

[@SpaceinvaderOne]

Yes it should. I am not a Plex user myself but Plex does allow you to add a custom url in the Custom server access URLS, setting in Settings - Network. This lets you specify the reverse proxy’s domain (e.g., plex.mydomain.com), so Plex clients will know to use that URL for external access, so then when you add the custom domain here, Plex will route traffic through the reverse proxy, and apps will be directed to this address for external access. Hope this helps :)

[@fizzyfrys]

the colons in the timestamps are breaking youtube chapter creation again :( needs the space right after time stamp

[@SpaceinvaderOne]

Um.. works for me on Safari and firefox?

[@fizzyfrys]

@@SpaceinvaderOne I checked on my phone and desktop. I can click the timestamps in the description, but it doesn't show them in the video player itself.

[@ottigreenisgo]

I have a question for anyone on here to hopefully answer. I have my server at home connect withough a CGNAT (normal ISP stuff) I sometimes will want to connect to my server at home over startlink when I am out on the road. Will this be an issue? Or do I need to follow the steps on this? My server will never be behind a CGNAT so I think i should be fine?

[@theethicsofliberty4642]

[@eduardocampo5781]

Hey Ed sorry to bother you can you please check on the step 6. Add the Docker GPG Key Always get error: HOPE that you can read it and point me were to look Ubunto 22.04 I get : missing argument for option "-o" curl: (23) Failed writing body Ubunto 24.04 I get : missing argument for option "-o" From there im not able to continue it always with out change the same error after that E: Malformed entry 1 in list file /etc/apt/sources.list.d/docker.list ([option] unparsable) E: The list of sources could not be read. root@ubuntu:~#

[@dlmac]

The Google Drive document he shared has double spacing, so you will need to paste into notepad and remove them.