Tailscale is available on Nucleus One, Nucleus Titan, and ROCK installed in UEFI mode. Your device downloads it from Tailscale's servers the first time it starts up, so it needs an internet connection then. To use Tailscale with Roon ARC, you'll create a free Tailscale account and install the Tailscale app on your phone. Then you'll sign your Nucleus or ROCK in from its Web Administration Interface.

Nucleus and Nucleus+ (Rev A and Rev B) and ROCK installed in legacy BIOS mode don't support Tailscale directly, because these devices can't run RoonOS 3.0. As an alternative, some users run Tailscale as a subnet router on another always-on device on their network. For details, please see this community discussion.

Before You Begin

• Time needed: about 5 to 10 minutes.
• What you need: the phone you use for Roon ARC, and a computer or tablet on the same network as your Nucleus or ROCK.

Step 1: Install Tailscale on Your Phone

1. On the phone you use for ARC, download and install the Tailscale app:
   • iOS: https://tailscale.com/download/ios
   • Android: https://tailscale.com/download/android
2. Open the Tailscale app and create a free Tailscale account. You can use any email address; it doesn't need to match the one you use with Roon.

Step 2: Sign In to Tailscale on Your Nucleus or ROCK

1. Open the Web Administration Interface for your Nucleus or ROCK.
2. Click the Network & Access tab. The Tailscale section shows Not signed in, along with the installed Tailscale version. If a newer version is available, you'll also see an Update button.
3. Click Sign in.

4. In the Enable Tailscale window, click Sign in to Tailscale. The Tailscale sign-in page opens in a new tab.
5. Sign in with the same Tailscale account you created on your phone.

When your Nucleus or ROCK is connected, the Tailscale section shows Connected, along with the account it's signed in to. Click the eye icon to show the full account name.

Once connected, a Use Tailscale DNS switch also appears. While it's on, Tailscale's DNS overrides the DNS server set under Networking.

From now on, the Logout button and the Use Tailscale DNS switch are locked when you open the Web Administration Interface from your local network. To change them, please see Signing Out or Changing Tailscale DNS below.

Signing in to Tailscale, or switching to a different Tailscale account or tailnet, removes any share password that was set from your local network. The share then goes back to guest access. Signing in again with the same Tailscale account normally keeps your password. For details, please see File Sharing for Nucleus or ROCK.

If the Tailscale sign-in page doesn't open, please temporarily turn off any browser content or pop-up blockers and try again.

Step 3: Test Tailscale and Connect to ARC

1. Restart Roon Server on your Nucleus or ROCK. On RoonOS 3.0, click Restart in the Roon Server row of the Overview tab.
2. Close and reopen ARC on your phone.
3. In the Web Administration Interface, check that the Tailscale row on the Overview tab shows Connected.
4. In Roon, go to Settings > ARC and enter 0 as the port to turn off port forwarding. If 0 isn't accepted, enter any number that gives a "Not Ready" status.
5. On your phone, turn off Wi-Fi so you're using cellular data only.
6. Open ARC and connect to your Nucleus or ROCK.

This is expected behavior: ARC checks for port forwarding, not Tailscale, so it may say your Nucleus or ROCK isn't accessible outside your network. If you see that message, please tap Connect anyway.

Signing Out or Changing Tailscale DNS

Once your Nucleus or ROCK is signed in, its Tailscale settings are locked when you open the Web Administration Interface from your local network. Logout and Use Tailscale DNS are turned off, and the page shows a message that starts "This appliance is signed in to a Tailscale account, so its Tailscale settings are locked". This stops anyone on your network from signing your device out or moving it to another account.

To sign out or change Use Tailscale DNS, please use one of these options:

• Your device's HTTPS Tailscale page: on a computer or phone signed in to the same Tailscale account, open https://<name>.<tailnet>.ts.net. You'll find the exact address in the Changing these settings box under File Sharing. This page needs MagicDNS and HTTPS Certificates turned on for your tailnet, on the DNS page of the Tailscale admin console.
• The Tailscale admin console: remove your Nucleus or ROCK from the Machines page.
• A reset: Reset on the Settings tab erases the Tailscale sign-in. It also erases your Roon database and settings, so please make sure you have a recent backup first.

Opening the Web Administration Interface by its Tailscale IP address, such as http://100.x.x.x, doesn't unlock these settings. Please use the https:// address instead. If you sign out from the HTTPS page, that page stops working, because your device is no longer on your tailnet.

Community Resources

For subnet routing with Tailscale, the most detailed discussion on our community is Tailscale implementation on ROCK/NUC to circumnavigate ISP CGNAT for ARC.

If ARC still can't connect over Tailscale after these steps, please get in touch with our Technical Support team here.