r/Tailscale • u/BiggyStroh • 2d ago
Help Needed Help with Tailscale Peer Relays
Hey all
I currently use Tailscale to remotely access my home media server. Because I cannot get P2P connections due to my ISP and CGNAT, when streaming from outside my local home network over Tailscale, the speeds can be slow.
So i just found out about the peer relays. I tried to follow the guide here: https://tailscale.com/docs/features/peer-relay
but couldn't get it working, stopped my from connecting remotely to my qBittorrent or Jellyfin so I went back to the settings I had and set the ACL JSON file back to the way it was.
I think I got confused on the tags, I hadn't used them before but I do think my syntax was correct. Am I wrong for trying to use my home media server as the Peer Relay? Can that not be done since it is hosting the files I am trying to stream?
Anyone point me to any other guides that helped them in setting this up?
2
u/Frosty_Scheme342 2d ago
Without knowing what exactly you did it’s hard to say what the issue is. It sounds like your home media server wasn’t tagged before, so you tagged it and then everything broke because your acl wasn’t set up for a tagged device…. You can use that machine as a peer relay but you’ll need to spend some time going through the acl to get your working set-up mirrored for a tagged machine as well.
2
u/or45t 2d ago
I might have something for you. Our setup and usecase sound similar. I recently setup tailscale and I'm also behind CGNAT(courtesy to my ISP, airtel). I assumed based on docs and llms that direct connections are not possible and derp hop is necessary.
For me the issue was that my tailscale was behind wsl layer on windows. This adds complexity and extra NATs. It makes tailscale create a hopped network. After directly installing it on windows and adding firewall rules I get a direct connection with ~20ms ping.
1
u/Budget-Apple-4703 2d ago
Peer relay has to be enabled on a device that has a publicly reachable IP address, not one that’s behind CGNAT. I personally set mine up on a VPS
1
u/pocketdrummer 2d ago
If you set it up on your local network (considering CGNAT), you're going to have a bad time. You need to have it on a VPS with a public IP. I ended up getting one for $5/mo, and it works like a charm.
1
u/tailuser2024 2d ago edited 2d ago
but couldn't get it working, stopped my from connecting remotely to my qBittorrent or Jellyfin so I went back to the settings I had and set the ACL JSON file back to the way it was.
Are you trying to setup the peer relay on your cgnat connection? As others have mentioned whatever device is gonna be the peer relay it needs to have a routable public ip address and open port directly to the internet.
If you are trying to setup a peer relay at a site that has a public routable ip address:
Can you post screenshots what you setup on the peer relay so we arent having to guess what you did wrong? You havent told us anything except "it doesnt work"
Can you post a screenshot of your port forward to your peer relay you made on your router to set this up
See if my post help clears up the tags stuff
https://old.reddit.com/r/Tailscale/comments/1sou838/peer_relay_limitation_or_acl_issue/
1
u/mintflowapp 2d ago
perhaps you can use the cli debug command to check if the client can see the relay servers
I use a modified headscale and modify some change to policy to let client discover the relay servers, but i think the official one should be same
if you cannot see the relay server in the client, you still need to check your acl/grant policy.
tailscale debug peer-relay-servers
4
u/godch01 2d ago
The peer relay device must be accessible via a public IP address and port forwarding. So if you only have a CGNAT network you can't set one up. You could use a clouded device VM to support it but that may cost money
I set one up only using ip-set as described in Tailscale documents. The dics may have changed.