What the author did
Mitchell installed Tailscale on the MacBook that hosts Jellyfin and on the iPad he uses to reach it remotely. Once connected, both devices showed as active in Tailscale and could reach each other. He says he didn't need router port forwarding or other tricky configuration to make the server publicly available.
This is one person's account. The write-up doesn't give Jellyfin or Tailscale versions, the macOS version, speed tests or the access-control settings. Treat it as a real-world data point, not a benchmark.
How the pieces fit together
Tailscale supplies the network path, not the media service. Tailscale's documentation says it provides connectivity between devices, but you must run the service you want on the destination device. Jellyfin still has to be running on the server.
Jellyfin's own documentation describes Tailscale as a WireGuard-based VPN. It suggests Tailscale where opening ports is undesirable or impossible, such as behind carrier-grade NAT or when an ISP blocks incoming ports.
The setup, step by step
The steps below follow Jellyfin's and Tailscale's documentation.
- Create a Tailscale account. Tailscale's guide says a tailnet is created automatically when you first authenticate.
- Install Tailscale on the Jellyfin host and sign in. On Windows and macOS, Jellyfin's guide says you connect through the system tray icon. On Linux, the command is
sudo tailscale up. - Note the server's Tailscale IP. It starts with 100, for example 100.12.34.56. If MagicDNS is enabled, you can use the hostname instead.
- Install Tailscale on each client and sign in to the same tailnet. This applies to phones, tablets and laptops. Tailscale says the connecting device must be on the same tailnet as the server.
- Open Jellyfin by address and port. In a browser or Jellyfin client, enter the IP and port, such as
100.12.34.56:8096. Tailscale's media-server guide gives the format[url]http://hostname:8096[/url]or[url]http://100.x.y.z:8096[/url].
Port 8096 is Jellyfin's default HTTP port. If you changed it, use your own.
To confirm the connection, Tailscale suggests running tailscale ip on a device to see its assigned address. Switching a client from home Wi-Fi to mobile data is a good test that you're really coming in remotely. One independent guide, from SmallGrid, recommends this.
Is it really "not exposed"?
Jellyfin's docs list directly forwarding ports to the internet as an option but mark it "not recommended". Tailscale avoids that, because only devices and users on your tailnet can reach the server. That's a meaningful improvement over an open port, but it isn't a security guarantee.
- Tailscale's default access policy lets you connect to all devices you own. If you share your tailnet, use the tailnet policy file to restrict who can reach the server.
- Jellyfin's own user accounts and permissions still matter. One third-party guide, from NatChecker, says to check the "allow remote connections" setting per user in the Jellyfin dashboard.
- Port 8096 is plain HTTP. Tailscale encrypts the network path, but that isn't the same as enabling HTTPS inside Jellyfin.
When it doesn't connect
Tailscale's troubleshooting advice for a failed service connection is a good checklist:
- Check you can reach the device with
tailscale ping. - Verify the address and port are correct.
- Confirm the service is running on the target at the expected port.
- Check firewalls, including the target device's built-in firewall.
- Make sure no policy rules in your tailnet block the connection between the two devices.
Community reports show the Jellyfin side can matter too. A Jellyfin forum user running Jellyfin on TrueNAS said remote access worked once they allowed remote connections. They also added Tailscale's 100.64.0.0/10 range to the remote IP address filter. That is a single user's fix, not official guidance, but it's worth checking if the filter is set up on your server.
Limits to know before you rely on it
- Uptime. The server must stay on and online. Mitchell notes his library goes offline when his home computer does.
- Upload speed. He says home upload speed affects remote quality, especially at high resolution. He gives no measurements, so treat this as a general limitation of home hosting.
- Every client needs Tailscale. Jellyfin's docs list this as a drawback. Guests, and some TV devices where you can't install Tailscale, are harder to support. For those cases, a reverse proxy with HTTPS is the usual alternative, with more setup and a public-facing endpoint. Third-party guides also say some TV platforms such as Roku and Fire TV can't run Tailscale natively, so check your own devices.
- A third-party account is required. Jellyfin's docs list this as a con.
- Jellyfin Mobile doesn't replace any of this. It's a client, so you still need a way to reach the server from outside the house.
Bottom line
For your own devices, this is a short setup that avoids port forwarding. It suits a household with devices that can all run Tailscale. If you want to share the library with people who can't install Tailscale, or stream to a TV that can't run it, plan on a different approach. Either way, keep both apps updated and review your access policies.