LMS remote access: safe, secure and free with Tailscale (mesh VPN)

[Ron F.]

I tried that. It did not work.

I have Block Incoming Connections set to Do not block (I also tried it set to Block with same results.)

Allowed IP Addresses includes a comma separated list of full IP address for the server device (local and Tailscale) and 127.0.0.1 and the Tailscale IP for the remote computer I am attempting to use to connect to the server.

I get the the error message: "403 Forbidden: settings/server/basic.html" when I navigate to Server settings. Unfortunately, the error message is almost invisible. It is black letters on an almost black background when using Material Skin. On the original web interface (not Material Skin) the error message is "403 Forbidden: settings/index.html" with black letters on white background.

Navigating to Server Settings via the LMS Tailscale IP Address works for me. Recalling what I had to do, (it has been a while now,) was to set a user name and password first by accessing settings using the server's LAN IP Address. Then it worked in all browsers, Android APK, and more recently the Melodeon app.

[bernt]

I had the same problem with settings page and Squeezelite-x so I gave up and returned to Zerotier.

[RTally]

There's a more efficient solution: Under Settings > Server > Security > Allowed IP Addresses, add the LAN and VPN addresses appropriate to one's configuration, but also add 127.0.0.1, which the local loopback IP address.

All the best... 😎

I tried that. It did not work.

I have Block Incoming Connections set to Do not block (I also tried it set to Block with same results.)

Allowed IP Addresses includes a comma separated list of full IP address for the server device (local and Tailscale) and 127.0.0.1 and the Tailscale IP for the remote computer I am attempting to use to connect to the server.

I get the the error message: "403 Forbidden: settings/server/basic.html" when I navigate to Server settings. Unfortunately, the error message is almost invisible. It is black letters on an almost black background when using Material Skin. On the original web interface (not Material Skin) the error message is "403 Forbidden: settings/index.html" with black letters on white background.

[artatgray]

My solution was to install NoMachine on my Inovato Quadra. Using Tailscale, NoMachine gives me access to a graphical interface on my LMS server. Using the GUI, I run Firefox to access LMS, including the settings pages. Works like a charm.

There's a more efficient solution: Under Settings > Server > Security > Allowed IP Addresses, add the LAN and VPN addresses appropriate to one's configuration, but also add 127.0.0.1, which the local loopback IP address.

All the best... 😎

[NFLnut]

This is the first time I've logged in here for quite a while. Glad to see this thread. I've been using Tailscale on my RAID server since September and it is pretty awesome. Not only can I securely access my files that I need when away from my home but one of the first things I did was set up LMS as I've wanted to have secure access to LMS away from home, as if I'm still in my local network, and it works flawlessly. It was almost too easy to set up, too (I'm not too experienced with VPNs).

[RTally]

anyone happened to have found out yet how to access LMS' settings page with this set up? i'm getting a 403 with

Access to settings pages is restricted to the local network or localhost: 100.76.230.123 -> 192.168.1.54 (settings/index.html)

in the logs. is there a way to configure LMS to allow another subnet?

tia.

As far as my research shows, not really without compromising security or increasing inconvenience. See Forbidden: settings/index.htmlSee post #125.

My solution was to install NoMachine on my Inovato Quadra. Using Tailscale, NoMachine gives me access to a graphical interface on my LMS server. Using the GUI, I run Firefox to access LMS, including the settings pages. Works like a charm.

[RobbH]

anyone happened to have found out yet how to access LMS' settings page with this set up? i'm getting a 403 with

Access to settings pages is restricted to the local network or localhost: 100.76.230.123 -> 192.168.1.54 (settings/index.html)

in the logs. is there a way to configure LMS to allow another subnet?

tia.

I do not know if this is relevant, but what are your settings in Settings > Advanced > Security > Block Incoming Connections and Allowed IP Addresses?

[markusk]

anyone happened to have found out yet how to access LMS' settings page with this set up? i'm getting a 403 with

Access to settings pages is restricted to the local network or localhost: 100.76.230.123 -> 192.168.1.54 (settings/index.html)

in the logs. is there a way to configure LMS to allow another subnet?

tia.

[ericj]

I set up Tailscale on my QNAP NAS as a subnet router as described in post number 7 of this thread, and I can access my Pi4 PcP LMS server remotely. No need to install Tailscale on the Pi.

Robert

My usage case would be different. I have done a subnet router elsewhere and it works great. However, this server is standalone on a university network and I don't need to have another machine running there or to make part of the university network part of the subnet, unless of course I would limit the subnet to a single machine (I'm a bit of a neophyte in more complex networking). Thanks in advance

[Grumpy Bob]

A related question. From what I can tell there is not a way of installing tailscale directly on a picore server. Does anyone have any ideas? There is a tailscale client for the pi https://tailscale.com/kb/1114/pi-hole/ for example, but will this survive a reboot?
I'll experiment more, but wanted to check if anyone has ideas from this helpful community.
Eric

I set up Tailscale on my QNAP NAS as a subnet router as described in post number 7 of this thread, and I can access my Pi4 PcP LMS server remotely. No need to install Tailscale on the Pi.

Robert

[ericj]

A related question. From what I can tell there is not a way of installing tailscale directly on a picore server. Does anyone have any ideas? There is a tailscale client for the pi https://tailscale.com/kb/1114/pi-hole/ for example, but will this survive a reboot?
I'll experiment more, but wanted to check if anyone has ideas from this helpful community.
Eric

[Ron F.]

Exit node...



I'd been meaning to ask you about this - - Is there a particular reason you chose to setup an exit node that way, as opposed to using native Tailscale exit node functionality? 😎

Sorry for the extremely late return ... pressing matters in life had taken over.

I am using a cloud-based exit node for a couple of reasons: I wanted my phone and laptop to have access to my home server running LMS. When traveling I wanted my phone to be able to use a VPN service to provide privacy/anonymity when moving through hotels, cafes, WiFi-equipped tour buses, etc. I would like more anonymity than using my home server as the exit node when traveling and having all my traffic routed back through my ISP when browsing the web. I also wanted to control DNS filtering myself. Additionally, mobile phones only support the use of one VPN at any one time, so a full-mesh VPN service was required. I settled on using Tailscale with a cloud-based exit node also serving as a DNS proxy. Using a cloud-based VPS (an amazing invention actually,) I can create (and later remove) an exit node to the web almost anywhere.

[artatgray]

Exit node...

The comment above about enabling an exit node is well taken; to this end I created a virtual machine hosted on a remotely located Oracle OCI server for this roll. I installed AdGuard-Home as a DNS proxy on the VM. Setting Tailscale's global DNS option to this exit node and using AdGuad's DNS over HTTPs (DoH) ability, DNS queries are now protected as well.

I'd been meaning to ask you about this - - Is there a particular reason you chose to setup an exit node that way, as opposed to using native Tailscale exit node functionality? 😎

[kartunes]

Since Tailscale is free for personal use, I wonder how difficult it would be to make it available in piCorePlayer?

If you turn on the subnets feature on the tailscale app running on the same network as your picoreplayer, you will be able to access it and any other device on your network without installing tailscale on those devices (which is not always possible).

Check out https://tailscale.com/kb/1019/subnets/ to learn how.

[artatgray]

Since Tailscale is free for personal use, I wonder how difficult it would be to make it available in piCorePlayer?

Its ease of use was the main reason I posted it here. I'm glad it's working out for you, too.

As for your question, it's not something that I've explored. However, I ran across the following which might to useful:

https://docs.picoreplayer.org/components/wifi/

All the best... 😎