Tailscale implementation with ARC to circumnavigate ISP CGNAT

In case you are currently unable to use ARC because you can’t forward a port due to your ISP using CGNAT (Carrier Grade NAT). A free solution is available that should suit most Roon users via one implementation or another.

The basis of the solution is that you run app on a machine in your local network which communicates with an app on your phone. The app on your local network creates a 'subnet router’ which allows your phone to behave as if it is still on the home network when you are mobile.

I am linking a video that shows how to achieve this if you have a Synology NAS. Hopefully other community members can contribute solutions to other scenarios.


There is also a useful guide on the Tailscale website which covers all scenarios, I am linking to the Synology NAS page.


I would encourage anyone to try this route. It took me about an hour, I had to learn how to SSH into my synology server, that process is described in the video and I found it easy to learn to do. The results are worth it if you are currently stuck unable to use ARC away from your home network.

Just to add, this only works because ARC believes it is on the home network with the core. In my case the core is an NUC running ROCK. This is why I needed Tailscale to function as a subnet router.

I’m linking more details from Tailscale regarding subnet routers, what they do and how.


I’m including a link for QNAP users that was provided down thread.

ARC support with CGNAT
SOLVED: Do I really need a static IP to make Roon Arc work?
Fixed IP needed to run ARC?
ARC Port forwarding issue (ASUS router)
Roon arc can't work
Roon ARC not working with Deutsche Glasfaser likely due to CG-NAT
Wightham Telecom: CG-NAT Blocks Port Forwarding w/out Requesting Static IP for Fee [See Staff Post]
ARC Double Nat on 4G Router
Roon ARC was unable to securely access my Roon Core via Fritzbox 7583
ARC: Closed-Loop VPN Mesh with NordVPN for Port Forwarding Workaround
Arc Setup help with mobile router and dynamic IP
Roon 2.0 on Qnap with Arc
Huawei Router B818-263 (LTE) and Roon Arc
[ISP Related] - UK Network EE - ARC with 4G modem for home (Archer MR600 with EE sim)
Is there a way to get ARC working over VPN?
Is Roon ARC a No-Go for T-Mobile 5G Home Gateway Users?
ARC port forwarding issue (Huawei B535-232)
Attention Salt. Users in Switzerland: CG-NAT Blocks Port Forwarding, Workarounds Required (See Staff Post)
Starlink compatibility for Roon ARC?
Roon ARC - not ready
Roon ARC wont connect to core
ARC with Tailscale port forwarding not required - IF Roon will listen on the IP, and ARC lets me specify the IP
Roon vs Plex - a serious discussion
Roon Arc not working, ISP done all they can
New user. “Roon ARC unable to access Roon Core” [Not Solved as of 18 March 2023]
My problem with Roon ARC it doesn't work
Cannot connect to Roon Arc perhaps VPN is causing Issues?
Can’t find Roon Core using Roon Arc: Need Help with Tailscale
ARC through SIM mobile receiver Continued
Plume Superpods and ARC
Australia: NBN Satellite Internet (Skymesh/ViaSat) Has Carrier-Grade NAT (Workarounds Required)
Roon Arc - Roon Core on Synology NAS - VPN
ARC port getting smacked about
Manually configure IPv4 address used (advertised IP) by Roon ARC (multiple WAN providers)

Good to hear it works with Tailscale, do you run Roon on the Synology NAS? I’m thinking in my scenario that if I manage to setup a Tailscale subnet router on another server it will work with my Rock install.

I think for this to work, Tailscale needs to be running on the same machine as Roon. It doesn’t work if you are using Rock. I tried it on Ubuntu last year with Roon running on that, and it almost worked. With Tailscale running on many of the platforms that Roon core runs on, this should hopefully be a good solution for the future.

How about starting a Tailscale on Rock campaigns :grin:

I am running Roon ROCK on an NUC and Tailscale on the Synology.

I’m pretty sure it will work with another machine running a Tailscape subnet router and Roon on the Synology. Or possibly both running on the Synology. As long as Tailscape is enabled as a subnet router.

It works now because ARC functions as if it’s on a home network. It wouldn’t have worked a year ago because Roon Remote doesn’t communicate with the core the same way.

It would be great if you amended your reply otherwise people might just give up before they even try, and I can assure you it works with ROCK as long as you make Tailscape create a subnet router. All of which is detailed in the video.

1 Like

Thanks Andy I understand that, I was just pointing out to those who think just having Tailscale on their network is enough.

This thread will be really useful for people, but a lot of Rock user’s will try this and fail for that exact reasoning. But I will watch the video and have a look. Maybe ARC is the game changer here.

I have Arc working great, but was thinking about going back to Ubuntu again and using Tailscale, but I want to see what Rock 2 brings and also if Tailscale performs as reliably as Arc on pure mobile. I have had performance issues with most mobile solutions, though Tailscale has so far worked perfectly for me across multiple laptops and PCs

I really don’t understand your point. ROCK works with Tailscape on a synology (or other machine) functioning as a subnet router. That is what the video instructs you to do. By all means point out the need for it to function as a subnet router but why continue to insist it’s not a working option.

I missed that part of the message.

I thought it was about running Roon on a Synology using Tailscale. I already have Tailscale running on my Synology so I will watch the video and see, that actually might give me what I was trying to get too without replacing Rock.

Yes ARC is the game changer because it’s designed to cope with small outages and operates on an IP basis where Roon Remote connects to the core via UDP.

1 Like

Ok I just bookmarked it to try later.
This is much bigger improvement than I had thought when I read the article headline.

Arc already work’s great but through this method I can use ARC use it in the office on a limited access network through Tailscale from my ipad or iphone that do not have Sims in them :smiling_face_with_three_hearts:

(as the person who introduced the firewall limits I am not going to turn it off :crazy_face:)

Great, pleased it can work for you. Here’s another video for the thread showing how to set up a Tailscale subnet router, not specific to Synology.



Hi Andy, Do you run Tailscale on iOS or Android my previous impression was that on iOS the background use of the Tailscale App was quite significant, it may I guess have improved of late with app updates.

beginner’s question here … I find myself unable to go through with Step 3.2 here:

3. Connecting to Other Devices on your Local Network

  1. Run the command below, substituting your internal IP subnet where the is listed below. To be clear, you should only be changing the 192.168.1 portion so that you’re able to connect to all devices on your local network.

sudo tailscale up --advertise-routes --advertise-exit-node --reset

what is my internal IP subnet?

Would be great if this works!

They do explain this in the video but my understanding is you should look at the ip addresses on your home network, if for example the ip address of your roon machine is your internal subnet is

The reasoning is the first three numbers are the address ranges that your internal DHCP server is handing out, you replace the last number with 0/24 because that is specifying the range of host addresses that can be handed out on the subnet.

If for example your ip addresses were commonly, or your internal subnet is likely

They say in order to learn something your teacher must understand it, so I wish you luck because this is a subject I’m am only just learning!

I’m running it on iOS. I’ve not checked the background usage! I’m sure there will be an overhead though. I am running a 12 mini which would make a good hand heater in the winter if it’s doing any kind of processing. I will have to see if I get battery issues I guess.

1 Like

I’ve installed on my Synology NAS, all seems to be working OK.
Disabled quick connect.
For my Synology Apps on the iPhone I changes the quick connect IP and replaced with the Tailscale IP for the NAS.

I ran the SSH commands but didn’t get the ‘success’ return but can see the options in the Tailscale dashboard.
Overall access seems faster than quck connect.
Just need to look at direct access to my IP cameras but that’s not a great issue as I can access via the DS CAM app.

Oh and I deleted all my port forward rules.
Overall seems a good find and easy to setup following the guide, applying to Synology.

Pleased you got a good result too. Especially as it was you that unlocked the thing for me with that video!

I didn’t get the ‘success’ return for the SSH command either. Just in case anyone else makes the same mistake the SSH commands are not uppercase although they appear to be in the video subtitles. SSH commands are lowercase.

The connection does seem very fast running on 4g and 200/200mbs fibre at the home end.

I noticed that running on 4g ARC downgrades the output to lossy, directly on the home network I get full 96/24 from the files I have in that format.

So after installing Tailscale I removed my quick connect access as it seemed prudent to limit access.

If I can get ARC workings through Tailscale and also working when going through dead Zones while driving, then like you I will remove my port forwarding rules.

Just to confirm that on my home network I have an intel NUC running Ubuntu 22.04 now connected to Tailscale as a subnet router. Roon Arc is working on iOS via the Tailscale VPN to my local ROCK install provided I perform the initial sync from my LAN. I cannot perform the initial sync via Tailscale VPN - lets see how it performs over time. Thanks.

Great that you have ARC working. I’ve seen reports about the initial sync being required from the LAN. Are you referring to the one off initial sync with the Roon core which should only be required once or some kind of sync that needs to happen more regularly?