LMS remote access: safe, secure and free with Tailscale (mesh VPN)

[artatgray]

After not too much effort, I'm able to access my Logitech Media Server remotely, securely and for free over cellular using a VPN.

Tailscale was the VPN application suite recommended to me by someone else and I'm happy to recommend it to you all here.

https://tailscale.com/

If I understand it correctly, the VPN IP addresses assigned to me by Tailscale are static until if/when I decided to delete my account there. So, I setup a rule in Windows Firewall that only allows inbound traffic from my LAN and VPN addresses. I've run a port scan on the external address of my LMS PC and everything came back as closed.


Now, as to the actual setup on my mobile:

I'm using SBPlayer Android on the phone, which provides the actual playback as a background process, and LMS Material Android as the remote control - as I normally would for any network player I've setup on my LMS PC. LMS Material is what's displayed on the screenshot.

By the way, SBPlayer has be launched immediately after turning on the VPN (i. e. Tailscale Android) in order for the LMS PC and LMS Material to actually recognize it. And, of course, Tailscale needs to be active on the LMS PC.

In SBPlayer, which streams from the LMS PC, I have a server profile that connects it to the VPN IP address, which Tailscale provides, of the PC.

Within LMS Material Android, I simply select the player named for the phone and control SBPlayer as if it were any other player.

It works flawlessly across both public WiFi and cellular networks.

[artatgray]

By the way, this works so seamlessly that I can remote control my network players here in the apartment via cellular as if I were accessing the same LAN that they're connected to.

[Franko]

This is great. Took me a few minutes to figure out. Beyond LMS it's really useful too. I'm sat in a caff with my laptop and phone on the same network as my home pc. Accessing work files, dropping new flacs into the lms server, and listening to music. Cheers

[artatgray]

This is great. Took me a few minutes to figure out. Beyond LMS it's really useful too. I'm sat in a caff with my laptop and phone on the same network as my home pc. Accessing work files, dropping new flacs into the lms server, and listening to music. Cheers

You're welcome. I'm glad it's working out well for you. By the way, if you've not done it already, you might want to enable the exit node on your home server and use it when in the cafe to encrypt your connection there.

I'd wanted to setup a VPN for myself for quite some time now, but always got annoyed trying to configure one - - I'm a software engineer by training and profession, and I still found it to be perplexing. Well, Tailscale changed all of that and I had it working within minutes. No port forwarding, no having to mess with the router configuration, which I couldn't have anyway since I don't have the administrator password. I probably didn't even need to setup that firewall rule I wrote about in the OP, but I did it anyway just to be sure.

I've informed all of my non-technical associates about Tailscale as well since it's user friendly enough for just about anyone to use.

All the best... 😎

[Ron F.]

I have been running Tailscale on my music server, laptop, Android phone, and my Raspberry Pi Zero client running Buster release & Squeezelite via (Termux.) Tailscale really is amazing; I have experimented with VPNs in the past, but this particular solution was so dead-simple to get running, it took me awhile to adjust!

The comment above about enabling an exit node is well taken; to this end I created a virtual machine hosted on a remotely located Oracle OCI server for this roll. I installed AdGuard-Home as a DNS proxy on the VM. Setting Tailscale's global DNS option to this exit node and using AdGuad's DNS over HTTPs (DoH) ability, DNS queries are now protected as well.

Since Tailscale is free for personal use, I wonder how difficult it would be to make it available in piCorePlayer?

[artatgray]

Since Tailscale is free for personal use, I wonder how difficult it would be to make it available in piCorePlayer?

Its ease of use was the main reason I posted it here. I'm glad it's working out for you, too.

As for your question, it's not something that I've explored. However, I ran across the following which might to useful:

https://docs.picoreplayer.org/components/wifi/

All the best... 😎

[kartunes]

Since Tailscale is free for personal use, I wonder how difficult it would be to make it available in piCorePlayer?

If you turn on the subnets feature on the tailscale app running on the same network as your picoreplayer, you will be able to access it and any other device on your network without installing tailscale on those devices (which is not always possible).

Check out https://tailscale.com/kb/1019/subnets/ to learn how.

[artatgray]

Exit node...

The comment above about enabling an exit node is well taken; to this end I created a virtual machine hosted on a remotely located Oracle OCI server for this roll. I installed AdGuard-Home as a DNS proxy on the VM. Setting Tailscale's global DNS option to this exit node and using AdGuad's DNS over HTTPs (DoH) ability, DNS queries are now protected as well.

I'd been meaning to ask you about this - - Is there a particular reason you chose to setup an exit node that way, as opposed to using native Tailscale exit node functionality? 😎

[Ron F.]

Exit node...



I'd been meaning to ask you about this - - Is there a particular reason you chose to setup an exit node that way, as opposed to using native Tailscale exit node functionality? 😎

Sorry for the extremely late return ... pressing matters in life had taken over.

I am using a cloud-based exit node for a couple of reasons: I wanted my phone and laptop to have access to my home server running LMS. When traveling I wanted my phone to be able to use a VPN service to provide privacy/anonymity when moving through hotels, cafes, WiFi-equipped tour buses, etc. I would like more anonymity than using my home server as the exit node when traveling and having all my traffic routed back through my ISP when browsing the web. I also wanted to control DNS filtering myself. Additionally, mobile phones only support the use of one VPN at any one time, so a full-mesh VPN service was required. I settled on using Tailscale with a cloud-based exit node also serving as a DNS proxy. Using a cloud-based VPS (an amazing invention actually,) I can create (and later remove) an exit node to the web almost anywhere.

[ericj]

A related question. From what I can tell there is not a way of installing tailscale directly on a picore server. Does anyone have any ideas? There is a tailscale client for the pi https://tailscale.com/kb/1114/pi-hole/ for example, but will this survive a reboot?
I'll experiment more, but wanted to check if anyone has ideas from this helpful community.
Eric

[Grumpy Bob]

A related question. From what I can tell there is not a way of installing tailscale directly on a picore server. Does anyone have any ideas? There is a tailscale client for the pi https://tailscale.com/kb/1114/pi-hole/ for example, but will this survive a reboot?
I'll experiment more, but wanted to check if anyone has ideas from this helpful community.
Eric

I set up Tailscale on my QNAP NAS as a subnet router as described in post number 7 of this thread, and I can access my Pi4 PcP LMS server remotely. No need to install Tailscale on the Pi.

Robert

[ericj]

I set up Tailscale on my QNAP NAS as a subnet router as described in post number 7 of this thread, and I can access my Pi4 PcP LMS server remotely. No need to install Tailscale on the Pi.

Robert

My usage case would be different. I have done a subnet router elsewhere and it works great. However, this server is standalone on a university network and I don't need to have another machine running there or to make part of the university network part of the subnet, unless of course I would limit the subnet to a single machine (I'm a bit of a neophyte in more complex networking). Thanks in advance

[markusk]

anyone happened to have found out yet how to access LMS' settings page with this set up? i'm getting a 403 with

Access to settings pages is restricted to the local network or localhost: 100.76.230.123 -> 192.168.1.54 (settings/index.html)

in the logs. is there a way to configure LMS to allow another subnet?

tia.

[RobbH]

anyone happened to have found out yet how to access LMS' settings page with this set up? i'm getting a 403 with

Access to settings pages is restricted to the local network or localhost: 100.76.230.123 -> 192.168.1.54 (settings/index.html)

in the logs. is there a way to configure LMS to allow another subnet?

tia.

I do not know if this is relevant, but what are your settings in Settings > Advanced > Security > Block Incoming Connections and Allowed IP Addresses?

[RTally]

anyone happened to have found out yet how to access LMS' settings page with this set up? i'm getting a 403 with

Access to settings pages is restricted to the local network or localhost: 100.76.230.123 -> 192.168.1.54 (settings/index.html)

in the logs. is there a way to configure LMS to allow another subnet?

tia.

As far as my research shows, not really without compromising security or increasing inconvenience. See Forbidden: settings/index.htmlSee post #125.

My solution was to install NoMachine on my Inovato Quadra. Using Tailscale, NoMachine gives me access to a graphical interface on my LMS server. Using the GUI, I run Firefox to access LMS, including the settings pages. Works like a charm.