u/Wild_Paramedic6641

Hi everyone, I have an issue with some containers due to the subnet changing the scope and I'm not sure how to handle it. Last friday after an update all the subnet changed broking my services.

The first issue is with Home Assistant: to reach it from WAN I had to set in the configuration file the allowed proxy IPs. I set the subnet of the network that it shares with Cloudflared, if this last container changes IP there is no problem, but when the scope went from 172.16.0.0/16 to 172.20.0.0/16 I couldn't reach it anymore.

The second issue is with Tailscale's docker, I use it with the SERVE function to reach other containers. With the containers I use the name of the services and it works even if the subnet change, but to reach the host I need to set the gateway IP, which went from 172.18.0.1 to 172.23.0.1

I added this section in the compose file under the network section:

networks
  cloudflared_net
    [...]
    IPAM:
      configuration:
        - subnet: 172.16.0.0/16

Now the networks are created everytime with the same subnet, but I'm not sure if there is a better way to handle it. Is it possible that docker now assignes the same subnet to one of the other networks and this create other problems? How would you manage it?

Thank you

SOLUTION(?): Following the comments I edit the file /etc/docker/daemon.json adding this 2 sections:

  "bip": "172.17.0.1/24",
  "default-address-pools": [
    {
      "base": "172.16.0.0/16",
      "size": 24
    }
  ]

I got crazy and lost a couple of hours because after the change docker didn't start anymore, I found that for the default bridge you have to write the IP of the gateway (172.17.0.1) and not of the network (172.17.0.0) like in the second section and it's not specified in the docker wiki, fml.

Buongiorno a tutti,

mi sento abbastanza stordito perchè sto cercando di configurare Tailscale per raggiungere alcuni servizi che ho sul server da remoto, ma non ci riesco nonostante abbia letto un sacco di procedure.

Sul server ho già installato e configurato nginx proxy manager per raggiungere i servizi di cui sopra quando sono in lan, ad es. omv.mydomain.net (che rimanda all'interfaccia di openmediavault su :8080), jellyfin.mydomain.net, npm.mydomain.net (che rimanda alla interfaccia di nginx su :81), etc.

Con tailscale vorrei poter raggiungere gli stessi servizi con omv.mytailnet.ts.net, jellyfin.mytailnet.ts.net, etc. ma non riesco nemmeno a far comunicare tailscale con NPM...

Al momento il file compose è così:

services:
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale
    hostname: homelab
    environment:
      - TS_AUTHKEY=<redatto>
      - TS_STATE_DIR=/var/lib/tailscale
    volumes:
      - ./tailscale-state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
      - net_raw
    restart: unless-stopped
    networks:
      - tailscale_net

  ts-proxy:
    container_name: nginx-4tailscale
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    environment:
      TZ: "Europe/Rome"
      DISABLE_IPV6: 'true'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    network_mode: service:tailscale

networks:
  tailscale_net:
    driver: bridge
    name: tailscale_net

Se provo a fare un primo test aprendo sul browser di un altro dispositivo homelab.mytailnet.ts.net:81 mi dice connessione non riuscita.

Cosa mi sto perdendo?

EDIT: controllando i log di tailscale ho visto questo blocco di errori

2026/06/16 13:04:03 localapi: [POST] /localapi/v0/debug
2026/06/16 13:04:18 localapi: [POST] /localapi/v0/debug
2026/06/16 13:04:24 netstack: could not connect to local backend server at 127.0.0.1:81: dial tcp 127.0.0.1:8081: connect: connection refused
2026/06/16 13:04:24 netstack: could not connect to local backend server at 127.0.0.1:81: dial tcp 127.0.0.1:8081: connect: connection refused
2026/06/16 13:04:24 netstack: could not connect to local backend server at 127.0.0.1:81: dial tcp 127.0.0.1:8081: connect: connection refused
2026/06/16 13:04:24 netstack: could not connect to local backend server at 127.0.0.1:81: dial tcp 127.0.0.1:8081: connect: connection refused
2026/06/16 13:04:24 netstack: could not connect to local backend server at 127.0.0.1:81: dial tcp 127.0.0.1:8081: connect: connection refused
2026/06/16 13:04:24 [RATELIMIT] format("netstack: could not connect to local backend server at %s: %v")
2026/06/16 13:04:24 magicsock: disco: node [A9F/u] d:996b12af6b3017f5 now using <redatto>:63553 mtu=1360 tx=6d0f48725ca5
2026/06/16 13:04:24 wgengine: sending TSMP disco key advertisement to 100.104.31.99
2026/06/16 13:04:33 localapi: [POST] /localapi/v0/debug
2026/06/16 13:04:48 localapi: [POST] /localapi/v0/debug

Da qui in poi continua ad aggiungere righe con scritto localapi: [POST] /localapi/v0/debug

Hi everyone,

TL;DR: I want to make the SSH connection from WAN available only when I need it thanks to docker.

I have an home server with Raspbian and a couple of container managed with docker compose.

I configured cloudflare to reach one of this container and it works fine. Now I'd like to add the possibility to reach the server via SSH from remote with the Zero Trust SSH terminal from browser, but I'd like to make the connection available only when I need it.

I found how to use CURL on the host to read a "switch" that I can enable/disable from remote, so I'm thinking to make a script in cronjob which every 5 minutes read the switch and "does something".

The first idea I had is to change the docker networks to enable the connection from cloudflared's container to the host, but I cannot find the right way.

The second idea is to have a container with ssh server and client to use as a gateway. I start the container, connect to it with cloudflared tunnel, then use a new ssh connection from the container to the host. I thought it could work, but I read here that container with ssh are a bad idea.

I need some help to finalize my project, but if you have other idea they are welcome!

Additional info:

• host is an RPI4 so its resources are limited;
• I choose the SSH terminal from browser because the other options require to install cloudflared installed on the remote client, so I couldn't use it from my work PC
• I would prefer to not work on the ssh server configuration to not risk to close myself out even from lan

Thank you so much

Hi everyone,

TL;DR: I want to make the SSH connection from WAN available only when I need it thanks to docker.

I have an home server with Raspbian and a couple of container managed with docker compose.

I configured cloudflare to reach one of this container and it works fine. Now I'd like to add the possibility to reach the server via SSH from remote with the Zero Trust SSH terminal from browser, but I'd like to make the connection available only when I need it.

I found how to use CURL on the host to read a "switch" that I can enable/disable from remote, so I'm thinking to make a script in cronjob which every 5 minutes read the switch and "does something".

The first idea I had is to change the docker networks to enable the connection from cloudflared's container to the host, but I cannot find the right way.

The second idea is to have a container with ssh server and client to use as a gateway. I start the container, connect to it with cloudflared tunnel, then use a new ssh connection from the container to the host. I thought it could work, but I read here that container with ssh are a bad idea.

I need some help to finalize my project, but if you have other idea they are welcome!

Additional info:

• host is an RPI4 so its resources are limited;
• I choose the SSH terminal from browser because the other options require to install cloudflared installed on the remote client, so I couldn't use it from my work PC
• I would prefer to not work on the ssh server configuration to not risk to close myself out even from lan

Thank you so much