Plex Remote Access Over Tailscale (No Port Forwarding)

Plex is wonderful at home and frustrating the moment you leave. Away from your network, streams crawl and buffer, or you find yourself staring at your router’s port-forwarding page wondering whether opening a hole to the internet is really a good idea. It isn’t the only way. I reach my server from anywhere over Tailscale — a mesh VPN (a private network that stitches your devices together over encrypted tunnels) — so my phone behaves as if it were sitting on my couch, and I never forwarded a single port.

This post explains why remote Plex is slow or risky by default, then walks through the two Plex settings that turn a Tailscale connection into a fast, direct one. It builds on installing Plex and the general-purpose Tailscale subnet router setup.

Why remote Plex is slow or risky by default

When a Plex app is away from home and can’t reach your server directly, Plex quietly routes the stream through its own Relay — a middleman server that both ends connect to securely. It’s a clever fallback that works from anywhere, but it comes with a hard ceiling: relayed connections are limited to 2 Mbps for free and paid accounts alike. That’s fine for music or a phone-sized episode, and nowhere near enough for a high-bitrate movie — so it stalls and buffers. If your remote streams look permanently low-quality, you’re almost certainly on Relay.

The classic way to escape Relay is to forward a port — tell your router to send inbound traffic on port 32400 straight to your Plex server. It works, but it means opening a door to your server that the entire internet can knock on. That’s a bigger commitment than most people realize, and it’s the part I never liked.

There’s a third path that avoids both problems: put your remote device on your network so the connection is direct, encrypted, and never leaves a private tunnel.

The plan: reach Plex over Tailscale

Tailscale builds a private mesh network across your devices using WireGuard, a modern, fast VPN protocol. Every device gets a stable 100.x address, and Tailscale connects them through NAT without any port forwarding — there is no inbound port to open, and the traffic is end-to-end encrypted. Install it on your Plex server and on your phone, and the two can talk as if they were on the same LAN, wherever you are.

The catch is that Plex doesn’t automatically know the Tailscale path is a good one. Left alone, it still hands remote clients to Relay. Two settings fix that: one tells Plex to advertise its Tailscale address, and one tells Plex to treat the tailnet as local. Let’s do both.

Task 1: Put Plex and your phone on the same tailnet

tailscale ip -4
# prints something like 100.x.y.z

Task 2: Advertise the Tailscale address to Plex

Plex publishes a list of URLs that its apps try when they connect. If your tailnet address isn’t on that list, the apps never try it and fall back to Relay. The Custom server access URLs field fixes that — Plex’s own docs call it out specifically for “if you’re using a VPN to get back home.”

Prefer to script it on a headless server? The same setting can be written over the Plex API — the copy-paste version is in the companion playbook.

Task 3: Treat the tailnet as LAN (and the one mistake to avoid)

Advertising the address isn’t quite enough. By default Plex treats any non-local connection as remote, which means it can still apply remote bandwidth limits and secure-connection requirements to your tailnet clients. The LAN Networks setting tells Plex which address ranges to consider local — and Plex lets you specify a range or a single address here.

Every Tailscale device draws its IP from one fixed block: the 100.64.0.0/10 CGNAT range. Add that block to LAN Networks and Plex treats every tailnet client as if it were on your couch — no relay, no remote cap.

The diagram below shows exactly what goes wrong and what to type instead:

Confirm you’re direct, not relayed

Two quick checks tell you it worked. First, in the Plex app while streaming remotely, open the playback settings — a direct connection shows as Remote (or the stream simply plays at full quality instead of the Relay cap). Second, from any device on your tailnet you can ask the server what it thinks each client is:

# Run from a device on your tailnet. A local client shows location="lan".
curl "http://100.x.y.z:32400/status/sessions?X-Plex-Token=YOUR_PLEX_TOKEN"

Look for location="lan" on the session — that’s Plex confirming the tailnet client counts as local.

If a remote 4K stream still won’t play smoothly once you’re direct, the bottleneck has moved from the network to the server’s CPU — that’s a transcoding problem, and it’s covered in Plex Direct Play and transcoding on weak hardware.

Why this is the most secure option

Port forwarding exposes your Plex server to the public internet and relies on Plex’s own TLS and auth to hold the line. The Tailscale approach removes the exposure entirely: there is no inbound port to open, and every byte between your phone and your server travels inside an encrypted WireGuard tunnel that only those two devices can read. Nothing on your router changes, and there’s no public endpoint for a scanner to find. You get the speed of a direct connection with a smaller attack surface than either Relay or a forwarded port.

Take private access beyond Plex

You can now stream your whole library from anywhere at full quality without exposing a thing. If you want the same no-port-forward reach for the rest of your lab — dashboards, other services — the Tailscale subnet router (in the related posts) extends this idea to every machine at once. And if a remote stream is smooth on the network but still struggles, the server-tuning side is covered in Direct Play and transcoding.

Related posts:

• Install Plex Media Server on a NAS or Proxmox LXC — the server this guide reaches remotely
• Plex Direct Play and Transcoding on Weak Hardware — the same LAN-vs-remote classification governs 4K playback
• Organizing a Plex Library: Naming, Agents, and Metadata — get the library itself in shape
• Tailscale Subnet Router: Remote Homelab Access Without Port Forwarding — reach your whole lab the same way
• Tailscale Exit Node: Route All Traffic Through Your Homelab — another way to use the tailnet you just built
• Plex vs Jellyfin: Which Media Server Should You Run? — if you’re still choosing a server
• Plex over Tailscale: direct-connection prefs — the copy-paste companion for a headless server