ive tried to ping my other connected device and resulted in timed out ping i dont think i have subnet set right looking for assistance
#Tailscale Subnet ping timed out
uncut forge
lyric iron
windows firewall blocks pings by default
uncut forge
i use kaspersky not windows firewall
lyric iron
though, just noticed thats tailscale ping and not regular ping, tailscale ping should work
uncut forge
well i originally had subnet as that
i tried 192.168.0.0/24
still cant tailscale ping times out
lyric iron
try /23 instead
also try running tailscale netcheck --verbose
uncut forge
and i think this routing issue is why i cant load my plex server through the plex app but can indirect load through browser
k what does this netcheck mumbo jumbo mean ?
im as green as they come to networking lol
see lots of stun packets and checks
lyric iron
it checks your connection health and connection to tailscales derp relay servers which are vital in establishing a connection between machines (connections are direct but they need some help from our servers to discover each other)
those results look fine
the other lines would only have been interesting if they failed but doesn't look it
what about the same on the other machine?
and try /23 for the subnet, using /24 can sometimes cause subnet overlap problems
lyric iron
did you try that on both machines?
uncut forge
well my other machine is iphone
...
wuhawk subnet is main device im not using not sure how to get rid of subnet tag for it
lyric iron
oh
on iphone if you hold your finger on a machine you can ping it, but there's no netcheck equivalent
lyric iron
what client version? also can you check your acl policy under access control on the admin panel
uncut forge
hit ping but nothings happening
latest client versionm
not sure where its listed for version
lyric iron
we do staged rollouts so latest has several meanings :)
uncut forge
im brand new to tailscale
lyric iron
tap the profile icon and then About Tailscale
lyric iron
that one should be good
can you check access control tab on the admin panel?
if you don't understand it you can screenshot it and I'll try to work it out
lyric iron
the file or the visual editor, either works
uncut forge
would i be able to stream some how ?
ill just remove acl after so my email not on here forever
i notice the routes didnt update in acl its still using old subnet i originally set
but it also was in same problem
set it to the new subnet pinged iphone ip from host still times out
lyric iron
those grants are really restrictive and don't allow any machine to access anything
uncut forge
how i fix
my sole purpose is to open plex app on phone and it shows my librarys tunnels to my host machine routes traffic as my host machine
lyric iron
first of all, youll want to stop tagging everything, you shouldnt tag phones or computers, only headless servers
tagging a device removes its user identity which causes problems
if the tailnet is only controlled by you and you trust every device on it, you should start from scratch with grants that allow everything to access everything
aha but you have a group with multiple users, thats why you want to have them restricted. you shouldnt use tags for this though
uncut forge
i think i messed everything up lol
lyric iron
i deleted the acl file because it has emails in it but only after i used it to understand whats going on
the ssh, tagOwners, nodeAttrs and autoApprovers seem fine, but the grants section is wrong
this rule:
{
"src": ["group:PlexMedia"],
"dst": ["tag:PlexUsers"],
"ip": ["tcp:32400", "*"],
},```
isnt working because when you tagged your devices they removed the user identity tying them to the group, so the `group:PlexMedia` no longer matches anythingi removed all my devices except host machine
reauthed with phone but 2 addresses under host for somereason and now connecotr needs review
i kind of wanna start from scratch at this point lol
but i forget the commands i used
lyric iron
these users listed under group:PlexMedia, are they added in the Users section of the admin panel or did you share an individual machine with them? this will change what policy you should write
uncut forge
yes
lyric iron
yes to which one :D
also yes, starting from scratch sounds like a good idea because this policy is a bit of a mess and youve screwed with the state of the machines by tagging them
uncut forge
kkk let me remove all machines
lyric iron
also deleting because it contains peoples email addresses but thanks it sounds like theyre added as external users
lyric iron
which machine does plex run on?
uncut forge
kk
im in an issue i deleted all devices
but now wants to send link to email but fails to do so
do i gotta reinstall the app?
uncut forge
k i just needed to close re oppen tailscale to reauth
lyric iron
alright
for the grants, i would just do json "grants": [ { "src": ["[email protected]"], "dst": ["*"], "ip": ["*"], }, { "src": ["group:PlexMedia"], "dst": ["100.x.x.x.x"], "ip": ["tcp:32400"], }, ],
where [email protected] is your personal email address, 100.x.x.x.x is the tailscale ip of the machine that runs plex, and group:plexmedia is the same group from before
then as long as you dont tag anything, that gives your machines access to everything and the other users machines access only to plex
uncut forge
ughhh one sec its not putting my iphone as a machine
lyric iron
then if you want to give the other users access to an IP on the subnet router you can add that to dst and add protocols/ports to ip as needed
this might make more sense if you view it in the visual editor, im just working from the json provided
uncut forge
k sorry i was getting iphone back as a machine
kk json file
i gotta reset it to default how do i do that?
lyric iron
honestly everything except the grants section is fine so i wouldnt
just replace the grants block with a new one
well
uh
this app connector is kinda weird too
but like
it wont cause harm either
hang on
uncut forge
well the app connector i got it to work before services...
first time i got it to work so its on a different tag :/
lyric iron
try resetting it to this ```json
{
"grants": [
{
"src": ["[email protected]"],
"dst": [""],
"ip": [""],
},
{
"src": ["group:plexmedia"],
"dst": ["100.x.x.x.x"],
"ip": ["tcp:32400", "*"],
},
],
"ssh": [
{
"action": "check",
"src": ["autogroup:member"],
"dst": ["autogroup:self"],
"users": ["autogroup:nonroot", "root"],
},
],
"groups": {
"group:plexmedia": ["[email protected]", "[email protected]"],
},
}
and fill in the emails and the ip of the machine with plexthat app connector has "domains": ["100.64.208.135"],
which is never going to work, that isnt what app connectors do
uncut forge
so dst is the ipv4 of host machine right?
uncut forge
- is all ports protocols right?
lyric iron
yeah
you want that for your own devices, and would only want to restrict it for other users
lyric iron
yeah
lyric iron
as far as i can see you dont need tags
auto approvers is only needed for app connectors, which also dont seem necessary for this setup
you can add those later as you need them, better to start with a mostly blank slate
uncut forge
to get the service of plex to work it said i needed app connector...
lyric iron
where did you see that said?
lyric iron
you can add those later as you need them, better to start with a mostly blank sl...
you may need to add something for the subnet later too, but this can be worked out
uncut forge
k i deleted the tags section now i got error
lyric iron
whats the error
youre missing a ], at the end of the grants section
add it after the last }, under grants
uncut forge
lyric iron
youre missing ], after ssh block as well
uncut forge
lyric iron
need it here
json is not great to work with so once this is over you can use the visual editor instead
uncut forge
k i deleted the tags i put ] there but still error line 23 column 2 invalid charachter ' after object value
lyric iron
] needs , after it
comma tells it theres more afterwards
] closes the list
so drop a comma on the end of line 22
lyric iron
you can remove the app connector for now
its invalid anyway, and doesnt provide any benefit
uncut forge
k
lyric iron
remove the whole nodeAttrs section so its like my small example
then if something doesnt work, can add things as needed from there
uncut forge
its removed
lyric iron
does it let you save now
uncut forge
kk this what it looks like now
lyric iron
great, but please do try not to keep sending email addresses in public messages
uncut forge
sorry
lyric iron
you should see ping working now, and can test other things and try setting up the subnet router
lyric iron
that should work now
lyric iron
great
uncut forge
direct connection not established
lyric iron
now test things like plex, and try advertising the subnet route
uncut forge
it says at end
lyric iron
that means your traffic is being relayed as some firewall or isp is preventing direct connections
lyric iron
connections will still work, just slow
uncut forge
or does the ip need to be more machine specific
lyric iron
subnet route being 192.168.0.0/23
yes
uh
sorry can i ask, why were you setting up the subnet router in the first place?
like did something say you needed it for plex
uncut forge
personally i didnt think i needed it ....
lyric iron
you might not
uncut forge
see when i first set up the service
it told me i needed app connector
and to have app connector i needed subnet routing
lyric iron
could i ask where you saw that was needed?
uncut forge
sec i got ss somewhere
lyric iron
i only ask because it sounds like you got quite confused down a rabbit hole of unneeded complexities and i'd like to know if theres anything we can do to stop people getting that impression in future
or if theres something extra i missed / didnt consider
re plex: can you try connecting to 100.91.232.49:32400 from plex, i believe it should work at this point assuming thats the tailnet ip of the machine running plex server
uncut forge
i cant find the ss :/
but basically
it started setting up the host
i typed the command that it told me to ...
and it just opened serve help list
from there i googled
and on google and from documentation app connector was mentioned
and i probably assumed service was listed ...
and that app needed to be setup for it to work through plex app
and then wound up the rabbit hole of app connector
and then got confused over 2 days
and then i finally figured right way to type the commands
because tailscale up dont work with setting subnets
which google and documentation says
i had to use tailscale set...
and the --advertise routes part
i had to ditch the -- before advertise
uncut forge
anyways been a 3 day struggle of mine
uncut forge
k i gotta put that as the custom url in plex
sec
so for custom url it be http:/100.91.232.49:32400
lyric iron
try http://100.91.232.49:32400 in a web browser too just to check
and try that same url in browser on the pc running plex as well, again just to check
lyric iron
you may have to reconfigure plex to listen on the tailscale ip
uncut forge
that im not sure how to do
...
thats all i have for network settings
maybe i need to list the ips for auth?
lyric iron
preferred network interface should have done it...
uncut forge
only shows my nord vpn and my wifi
lyric iron
you restarted plex after reauthing tailscale right?
uncut forge
yeah i just restarted plex like 5 mins ago
but its never showed tailscale under that list
like for the 3 days ive been playing around with tailscale
uncut forge
i know they making it so you have to pay to remote ....
but nord meshnet worked with out having to have remote pass or plex pass
when i heard about tailscale im like perfect its a tunnel same as meshnet
lyric iron
i have two different ideas
idea 1, try running tailscale serve --bg --tcp=32400 127.0.0.1:32400
then check it again with the tailscale ip
if that fails, idea 2, run
tailscale set --advertise-routes=192.168.50.156/32
then try accessing http://192.168.50.156:32400 from the other devices instead
lyric iron
btw based on that screenshot your network is 192.168.50.xxx, so the subnet route you advertised previously was never going to work since its the wrong subnet
(you were using 0 instead of 50)
uncut forge
well i had it 192.168.50.0
at the very begging
rabbit hole told me i did it wrong lol
lyric iron
you were misinformed
uncut forge
i tried 192.168.50.1 wouldnt let me
lyric iron
a lot, it seems
uncut forge
but when i dropped the 1 and put 0 it worked
lyric iron
anyway
uncut forge
k doing second command as webpage still isnt working now
lyric iron
that second command advertises just the ip address of your computer, not anything extra, so theres less chance for it to break or cause unwanted consequences
uncut forge
k it worked on phone
lyric iron
good
uncut forge
So I’d put that link to plex custom url ?
lyric iron
yes
to get your other users to access it youll also need to add "192.168.50.1/32" to the dst of your restricted grant
lyric iron
the only warning i will give is, this might break if your home router decides to change the local ip of your machine, if you have access to the router settings you can set a static local ip to fix this
and i don't know why it didnt work with the tailscale ip, it should have, but maybe this is part of plex cracking down on people bypassing their restrictions
uncut forge
k so grants bottom or top section
lyric iron
it might do it often or it might do it never, i dont know what to tell you there
you can always just wait until it breaks and fix it when it comes up
uncut forge
and ip end they never change ip
lyric iron
thats what you needed to add to acl too
uncut forge
oh so it did change
lyric iron
i think youll be fine
uncut forge
thats my default gateway
lyric iron
if it ever breaks, find the new ip (plex showed it on that network adapter dropdown), run tailscale set --advertise-routes=192.168.50.156/32 but with the new ip (instead of 156 itll be smth else), update the acl and the ip in plex apps and youre fine again
but itll probably be fine
you can also try setting a static ip in windows but depends whether your router accepts that
uncut forge
k i saved that msg to a note pad lol 😛
lyric iron
i personally wouldnt worry for now
lyric iron
if you can set static then do it
uncut forge
but like i said earlier im very very green to anything network
lyric iron
but well
lyric iron
as long as its the private ip thats static, it doesnt
this is very confusing territory because static public ip is a different but similarly named thing youll run into
uncut forge
yeah id have no clue how to set it up without downing my internet lol
lyric iron
- its not a tailscale thing really, and i have no experience with asus routers, so i cant help with step by step instructions there
uncut forge
like least i could do is ss the static ip section...
lyric iron
you could and i might be able to identity the right button
but i dont know how it all works for asus beyond that
uncut forge
if i can find where that static section is again
lyric iron
maybe its this https://www.asus.com/uk/support/faq/1000906/
this page says go to LAN > DHCP Server, enable this and then set the static values there
uncut forge
lyric iron
oh cool
so
wait, thats the wrong tab
go to DHCP Server, not route
you dont want to touch static routes, you might seriously break your network
uncut forge
lyric iron
welcome to networking btw, where we have multiple things with similar names that are completely different
uncut forge
lol so im learning...
lyric iron
okay so
firstly, do not touch anything under basic config or dns and wins server settings
uncut forge
lyric iron
under Manual assignment, set "Enable Manual Assignment" to "yes"
then check the dropdown under Client Name and see if your pc shows up
uncut forge
yup
lyric iron
select it from the list
uncut forge
k
lyric iron
so its now listed there alongside the others?
uncut forge
yup
uncut forge
i dunno why the others are there to begin with ...
i dont remember setting statics to themlol
lyric iron
i guess someone set them at some point
or maybe asus decided they need to be static for some reason
uncut forge
woulda been me ... probably "LEARNING"
lol
yeah or they were default
i dont remember doing it
lyric iron
it doesnt really matter anyway
setting devices with static local ips doesnt cause any harm
i appreciate this was more complicated than your last setup, but you should be good now. i think the tailscale ip not working may have been related to plex trying to force you down their path of remote access, which you successfully bypass using this static ip and subnet route
uncut forge
k so none of this should expose my network right?
lyric iron
nothing we covered in this thread would have, nope
uncut forge
yeah the only reason why i did this is i was originally using nords meshnet ... but apparently not enough users used it so they discontinuing it come december
so ive been desperatly trying to find an outlet
tried zerotier it sucked ass worked but lot of disconnect and slow
heard of cloudflare but they dont like streaming
lyric iron
ah yeah, we have seen a lot of people coming in from meshnet for the same reason
uncut forge
then tailscale came across my tik tok
and was like bro this is meshnet but more complicated but will work
then tiktok guy was like yeah you just install it and it auto picks up the service will just work
and then i ran down my rabbit hole
and here we are working
so thank you very much 😄
lyric iron
for most services its true that its automatic, but plex makes things intentionally difficult because they dont want you to do this
uncut forge
so now when i add say my tv i just connect to my tailscale and it should work
dont need to tag or do anything to it
lyric iron
just connect and it should work yeah
uncut forge
or my other user being my sister
lyric iron
other users should work too
uncut forge
wish google didnt bring me down the rabbit hole :/ lol
i dunno why i didnt just look up tailscale discord
this was honestly my last resort i tried hard to do it myself
lol
lyric iron
sadly a lot of stuff on google and other search engines these days is powered by AI tech which has trouble understanding nuances of specific products and can lead people down the wrong path
uncut forge
oh co pilot and chat gpt failed me lol
but now i think i understand the grants so dst "*" opens it up to all groups users
and then the second section
specifies what it was for
lyric iron
if you visit https://tailscale.com/kb theres an Ask AI button in the bottom right corner which is one we tuned specifically to give advice on using tailscale and is miles better than chatgpt or copilot
though if you ask me theres little replacement for humans when things get complicated, which is why this discord server exists
uncut forge
yeah we far out before software engineers get replaced
there will always be a bug or something
technology just hates me my computer buddy that knows his stuff questions why i have the most random weird broken ass problems
he just gives up trying to help me now lol
lyric iron
i was beginning to question that at the start but then i took it as a challenge
uncut forge
he also hates windows now too so his thing is windows 11 rip go to linux
regardless if its building pc setting up os anything
if the most random thing that google has no awnsers for
it happens to me
and every time im alone struggling till i get it
very seldom i get help cause i dont know anyone really
i get told google is your friend lol
like i made a dual boot kali linux and EVERY single time i messed it up or got lost id restart from scratch
till i got it
lyric iron
google is your friend until its not
uncut forge
and every SINGLE TIME it was different
followed every step command ect
and somewhere within it it would act different
even the os install page would do different things
lol
i gave up with kali when i couldnt use my mic ... cause linux doesnt support dual mic plexing or whatever for my old soundcard
i spent about 2 weeks trying to get the mic to work ! lol
than i figured kali is hardcore rolling and why it was different every time
and i got tired of re setting it up
i do want a dualboot linux of somesort
less bloat faster os looks nice n clean
plus has all the tools to learn from
i plan to go to school for something in IT but i question that decision with how random and bad my luck is
lyric iron
which one works best depends on your specific hardware, but theres no guide that says if you have this then install that, so it mostly becomes a game of trying them until something works
uncut forge
and only people i know are people in there 50s plus who couldnt find the X to close an internetbrowser
and i get reallly impatient trying to help
id hate to do it daily
uncut forge
no if you seen some of the questions and help .... from family / family friends
oof
over the phone at that
one was hotmail.com there inbox > was closed
i spent 2 hours trying to explain where the >
was to open it
until i figured it was easier to get them to download anydesk
and do it for them
lyric iron
was just joking because i help people use tailscale for a living lol
that sounds annoying
uncut forge
see i do enjoy helping people
but there is a limit to patients lol
its different when you can remote or have the device infront of you
or atleast a person who can do basic navigation
lyric iron
even sharing screenshots is miles better than a phone call
uncut forge
yes
but moms bf sadly doesnt even know how to send an email or take a photo and send a photo over text or facebook
hhaha
wild
everything for the most part of what i know i trialed and errored like a mofo and relied on google
lol
lyric iron
i mean, doing that for 10+ years is how i got where i am
its real annoying but it works
uncut forge
well ive been doing it since i was 8
i wanted to learn cyber security because back when i was 8 people used to hack my accounts
and steal my LOOT
how i met my computer guy
cause he was a scammer on d2:P
and then blizzard turned into like cyber warefare for clan battles
taking over websites stealing accounts stealing cdkeys proxy flooding channels
ect ect
so started with google whats a proxy
google was xxs
ect ect
LOL
and whats funny is if you google any of that that was happening on blizzard across sc d2 and wc3
it didnt exist
the only thing that exists now is stealthbot on github
in 2015 they scrubbed the internet
none of that shit ever happened apparently
i learnt about prorat when i was like 10 lol
god internet was excessivly free in the 90s early 200s
2000s**
then after wrapping my head around basic concepts i got to a point where without guidance sandboxs or community i physically couldnt learn anything
so i just gamed and things just worked
so i never dived much into things
hmm phone now says server is offline... ?
lyric iron
but it works from pc?
uncut forge
yes
lyric iron
does it work from the phones browser