Get around the Plex Pass and Remote Watch Pass requirements for Plex remote access by using Tailscale

updated

Beginning April 29th, 2025 the pricing for Plex Pass increased at the same time that remote access got paywalled behind it. Plex no longer allows streaming your own content outside of your home network without paying for Plex Pass, or the new Remote Watch Pass. You can bypass these paywalls, at least for now, by using Tailscale.

Table of Contents

  1. About Plex and the service changes
  2. About Tailscale
  3. The Workaround
  4. Pre-Requisites
  5. Set up Tailscale on Plex server
  6. Configuring the Plex server as subnet router and exit node
  7. Set up Tailscale on a Windows Laptop and/or Android Phone
  8. Configure the Plex server for Plex apps
  9. References

I have received confirmation from several people that remotely accessing Plex works with this setup without Plex Pass or Remote Watch Pass, at least for now — it’s entirely possible Plex will change something in the future to break this workaround. In fact, I would not be surprised if they do.

Please feel free to contact me and let me know if you have any issues, or even to let me know that it did work!

About Plex and the service changes

Plex Media Server is a self-hosted media server that lets you stream your owned (ripped, downloaded, or otherwise acquired) media from other devices on the same network, through a web-based GUI (access via browser) or dedicated app. (Say, on a smart TV or Roku device.) Plex lets you stream videos and music through a slick Netflix-like user interface, and Plex also offers the excellent Plexamp music player app for Android and iOS devices, so you can stream music on the go through a dedicated UI. Plex can also let you view photos, but this feature is nothing to write home about, in my opinion — stream movies and TV shows is Plex’s bread and butter, with built-in fetching of metadata, posters, etc.

Plex Media Server has a built-in feature called Remote Access that can be configured from the web UI. By enabling Remote Access, and forwarding network port 32400 from your router (ideally with some firewall rules for security), you can access Plex from other devices using your account, like a phone or tablet. It also allows you to share your media library externally with other users, allow them to access your server and stream the shared content. (This does not to work behind CGNAT, however, which is why I started using Tailscale for remote access and library sharing in the first place.)

The remote access feature, as well as sharing your library with friends, has always been free until the Plex service changes and price increases on April 29, 2025. From that day forward, remote access — by yourself and by others you’ve shared library with — is now locked behind Plex Pass. If you bought a Plex lifetime pass before that date it was $119, with occasional sales as low as $80, but after the change it now costs a whopping $250 for the lifetime pass. That’s a more than 100% increase on the base price!

The monthly Plex Pass subscription also rose from $4.99 to $6.99 per month, a less egregious price increase. However, keep this in mind — at the old prices, a lifetime pass of $120 was roughly equivalent to two years at $5/month, so it paid for itself after two years. With the new pricing structure, a $250 lifetime pass is roughly equivalent to three years at $7/month. No matter how you slice it, the value proposition is less than before.

So basically if you’re running a Plex server on your home network, a Plex Pass will be required both for accessing your own content from your own devices outside your network (remote access), and also for allowing other users to access shared library content. If you only care about sharing with others, each of those other accounts you’ve shared with can choose to pay for their own Remote Watch Pass subscription at $2.99, which will allow them to access your shared content without you, the owner of the Plex server, having to pay for Plex Pass. (Keep in mind that hardware transcoding has always been locked behind Plex Pass and this has not changed.)

About Tailscale

Tailscale is a mesh VPN service that lets you connect multiple devices across different networks seamlessly as if they were on the same network. Tailscale creates a Tailnet that all your devices will join as nodes, a coordination server facilitates NAT traversal to punch through firewalls, negating the need for port forwarding (technically safer than Plex’s built-in remote access), and exchanges encryption keys between devices. After the handshake it’s handed off to the individual nodes which are now directly connected to each other through encrypted WireGuard tunnels. Each node is directly connected to every other node, creating a mesh rather than a hub-and-spoke design — the coordination server is only ever involved to help reconnect nodes to each other and to propagate configuration changes. See how it all works here.

The Workaround

Per this comment on the Tailscale subreddit, you need to set up Tailscale on the Plex server as both subnet router and exit node, and set the external device you’re connecting with (phone, tablet, etc.) to use the Plex server as exit node. I have a lifetime Plex Pass and only use Tailscale to punch through CGNAT, so unfortunately I am unable to test this myself, though why the method works makes sense — by connecting to an exit node in the same network, you’re routing traffic from the remote device through the exit node, so it will appear to Plex as a local stream.

I have been told by many people that the below instructions have worked to allow them to remotely stream their own library without having a Plex Pass or Remote Watch Pass. I don’t know if it also allows external users to remotely stream a shared library, so please feel free to let me know if it does and I can credit you if you’d like!

Please make sure you follow the instructions below on how to setup the Plex server as both subnet router and exit node, since both are necessary and you must be connected to an exit node in your home network to access it remotely.

Pre-Requisites

This guide assumes you have a Plex server already set up and that it’s running on Linux. I won’t go into how to install Plex here, see this article for detailed instructions on running Plex as a Docker container in Linux.

Note that I use plain Linux to run Plex in a Docker container, there may be additional configuration needed to run Plex on Proxmox, TrueNAS, Synology, etc. I can’t help you with that, since I don’t run Plex on any of those and have no interest in doing so.

This post will instruct you on how to run Tailscale on the same machine running Plex, but alternately you can run Tailscale on a separate machine in your network and configure it as subnet router. I won’t cover that here, see this section of my comprehensive Tailscale guide or check out the Tailscale documentation for details.

I’ll provide instructions to install and configure Tailscale on the Plex server and on other devices, specifically a Windows laptop and Android tablet. (It should work similar on iOS, the apps look identical at least, but I don’t have an iOS device to confirm this myself.)

Set up Tailscale on Plex server

Go to the Tailscale website and create an account. This will create your Tailnet (private mesh network for all your Tailscale-connected devices) with your newly created account as the Owner and which you’ll manage through the web-based admin console.

Once you’ve got the account created, use the following command on the Plex server terminal to install Tailscale:

curl -fsSL https://tailscale.com/install.sh | sh

Once it’s finished installing, use the command sudo tailscale up and go to the provided URL and login to authenticate the node with your Tailscale account. You should then see the server listed under Machines in the Tailscale admin console. (The rest of this guide will assume your Plex server’s machine name is plex, but take note of what the name is in your case.)

This next part is optional, but I think it’s a good idea, which is to rename your Tailnet. On the admin console go to the DNS tab. Notice that the Tailnet name is something auto-generated like tailfe8c.ts.net. You can keep this if you want, but you may want to change it to a “fun name” that is more human-readable and easier to remember. You can’t just type one in, instead you choose from ones generated by Tailscale.

Choosing a tailnet fun name.

Click the Rename tailnet… button and follow the prompts. You can keep reloading until you find a fun name you like. For future examples, we’ll assume your tailnet name is royal-marmot.ts.net and therefore the Plex server’s domain is plex.royal-marmot.ts.net.

Configuring the Plex server as subnet router and exit node

As explained at the top, it seems Plex remote access and library sharing will not work without this. (If you have Plex Pass and are only using Tailscale to punch through CGNAT, then you can skip this part.) First, in order to use either subnet routing or exit node, you need to enable IP forwarding on the server. (This is straight from the Tailscale docs.)

If your machine has an /etc/sysctl.d directory (which most likely it does) then use these commands:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

If your machine does NOT have the directory (ls /etc/sysctl.d returns No such file or directory) then instead use these commands:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p /etc/sysctl.conf

Also, if you are running firewalld on your server, you should allow masquerading with the following command:

sudo firewall-cmd --permanent --add-masquerade

Now we’ll advertise both the subnet routes and the exit node with this command. Make sure to use the correct subnet for your LAN — if your Plex server’s local IP address is something like 192.168.0.100 then subnet will be 192.168.0.0/24, if it’s instead 192.168.1.100 then your subnet is 192.168.1.0/24, etc.

sudo tailscale up --advertise-routes=192.168.0.0/24 --advertise-exit-node

Now go to the admin console, on the Machines tab, and do the following:

  1. Click the three dots to the right of the machine want you want to use as subnet router. (Notice the subnets tag.)

  2. Choose Edit route settings… from the dropdown menu.

  3. Click both checkboxes for Subnet routes and Use as exit node, then click the Save button to finish.

Enabling subnets in Tailscale admin console.

Enabling exit node in Tailscale admin console.

If you are running Tailscale on multiple machines in your home network, you should use the command sudo tailscale up --accept-routes=false on those other machines, that way they will keep using local routes (e.g. 192.168.0.x) instead of going through the tailnet — you don’t want to access your local network resources through Tailscale when you’re home!

Set up Tailscale on a Windows Laptop and/or Android Phone

Now let’s install Tailscale other devices you want to access Plex from, I’ll walk you through installing and setting it up on Windows and Android, but for other clients go to the Tailscale admin console, click on the Add device button, and choose your client. Alternately just go to this link to see all the clients.

For Windows, go this link, click the download button and follow the instructions on that page to set it up. You’ll be taken to login with Tailscale and authenticate the device, then you’re ready to go. When the Tailscale app is running and connected (you’ll see the Tailscale icon in your system tray), you’ll be connected to your tailnet — make sure to click on the Tailscale icon, hover over Exit nodes and choose your Plex server from the menu.

For Android, either go to this link this link and use the QR code, or just go to the Google Play Store and download the app. (Make sure it’s the official Tailscale app!) The app will be installed as a VPN, and when you login you’ll be taken to Tailscale to authenticate the device. You’ll use the Tailscale app to connect to your tailnet. To use the Plex server as exit node on your phone/tablet, open the Tailscale app, tap the Exit Node button at the top and the Plex server should appear as an option — tap on it to use it as exit node.

If you’re using a Linux device, there’s no GUI for Tailscale, instead to use the Plex server as exit node use the following command in a terminal: (Make sure to use the machine name of your Plex server, or the server’s Tailscale IP.)

sudo tailscale up --exit-node=plex

Now you should be able to access Plex on your browser at http://plex.royal-marmot.ts.net:32400 when connected to Tailscale. However, watching Plex exclusively on the web UI is not a great experience, especially on phone and tablets. Let’s do some additional configuration to be able to use Plex apps through Tailscale.

Configure the Plex server for Plex apps

The following will be necessary if you want to use Plex apps on phones, smart TVs, and other devices.

  1. Go to the Plex web UI of your server on a browser, and click on the the wrench icon at the top-right to go into Settings.

  2. On the sidebar, scroll down to Settings section and click on Network.

  3. Next to Secure connections, choose Preferred from the downdown menu.

Secure connections setting in Plex.

  1. Make sure to leave disabled the checkbox for Enable Relay.

Relay and Custom access URL settings in Plex.

  1. This is the really important part. Under Custom server access URLs type in https://plex.royal-marmot.ts.net:32400 as well as your Plex’s server’s Tailscale IP, i.e. http://100.200.300.400:32400. (Make sure to use http for this one, this is a fallback in case HTTPS does not work.) You can get the machine’s Tailscale IP from the admin console.

  2. Scroll down to the bottom of the page and click the Save changes button.

Now your Plex apps should be able to connect through Tailscale!

References