Skip to content

Network IPAM & Tailscale Reference

Complete operational matrix for local network addressing, service ports, Tailscale mesh ingress, and Subnet Router configurations for the homelab.

1. Service Port Matrix & Endpoints

Service Host Port Internal Container Port Protocol Profile Client / API Endpoint
Documentation Runbook 8000 8000 HTTP 24/7 http://<host>:8000 (Web Browser / PWA)
Immich Photos & Video 2283 2283 HTTP 24/7 http://<host>:2283/api (Immich Mobile App)
Navidrome Music Server 4533 4533 HTTP 24/7 http://<host>:4533/rest (Subsonic / Symfonium)
Calibre-Web E-Books 8083 8083 HTTP 24/7 http://<host>:8083/opds (KOReader / OPDS 1.2)
qBittorrent Web UI 8080 8080 HTTP Phase 8 http://<host>:8080 (Via Gluetun sidecar)
Audiobookshelf 13378 80 HTTP 24/7 http://<host>:13378 (ABS Mobile App)
Immich PostgreSQL None 5432 TCP 24/7 Internal Docker network only (immich-postgres)
Immich Valkey Cache None 6379 TCP 24/7 Internal Docker network only (immich-valkey)
Immich Machine Learning None 3003 HTTP ml (On-Demand) Internal Docker network only (immich-machine-learning)

[!NOTE] Internal Database Isolation: Databases (immich-postgres, immich-valkey) do NOT bind to host ports. They communicate exclusively over the private bridge network (homelab-net).

2. Tailscale Mesh Networking Architecture

The homelab operates on a Zero Public Open Ports policy. No dynamic DNS, router port forwards, or public IPv4 addresses are exposed to the internet.

flowchart TD
    subgraph Mesh ["Tailscale Encrypted Mesh (100.x.y.z)"]
        Phone["📱 Mobile Phone\n(Tailscale App)"]
        Laptop["💻 Laptop\n(Tailscale App)"]
        EReader["📖 E-Reader\n(KOReader via Subnet Router)"]
    end

    subgraph ServerNode ["HP ProDesk ('homelab')"]
        Tailscale["🔐 Tailscale Daemon\nMagicDNS: homelab"]
        Services["🐳 Core 24/7 Stack\n(:8000, :2283, :4533, :8083, :13378)"]
        SubnetRouter["🌐 Subnet Router\n(--advertise-routes=192.168.1.0/24)"]
    end

    Phone -->|Direct WireGuard| Tailscale
    Laptop -->|Direct WireGuard| Tailscale
    EReader -->|LAN HTTP| SubnetRouter
    Tailscale --> Services

MagicDNS Hostname Resolution

All devices logged into your Tailscale tailnet can reach homelab services using the friendly hostname homelab:

  • Homelab Runbook: http://homelab:8000
  • Immich Server: http://homelab:2283
  • Navidrome: http://homelab:4533
  • Calibre-Web: http://homelab:8083
  • Audiobookshelf: http://homelab:13378

3. Tailscale Subnet Router Configuration

For devices that cannot install the native Tailscale client (such as Linux-based E-Ink readers like Kobo/Kindle running KOReader), the server acts as an in-network Subnet Router:

1. Enable IPv4 Forwarding on Host

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

2. Advertise Local Subnet

sudo tailscale up --advertise-routes=192.168.1.0/24 --accept-routes

3. Approve Routes in Tailscale Admin Console

  1. Open Tailscale Admin Console.
  2. Locate the homelab machine.
  3. Click Edit route settings... → Approve 192.168.1.0/24.

4. Exit Node Configuration (Secure Travel)

The server can also act as an encrypted Exit Node to route all your laptop and phone internet traffic through your home fiber/broadband connection while traveling on public Wi-Fi:

# Enable exit node advertisement:
sudo tailscale up --advertise-exit-node

# In Tailscale Admin:
# Locate 'homelab' -> Edit route settings -> Approve exit node.

5. Split-Tunneling & Commercial VPN (ProtonVPN) Coexistence

By default, Tailscale operates as a Split Tunnel, meaning only traffic destined for the homelab (100.64.0.0/10 and homelab) passes through the encrypted WireGuard mesh. All normal web traffic (streaming, web browsing, banking) continues over your native local connection or commercial VPN.

  1. Zero Home ISP Upload Bottlenecks: Avoids the "hairpinning" trap where external internet speed on mobile is capped by your home broadband upload bandwidth (e.g., 20 Mbps on cable connections).
  2. Minimal Latency: Web requests travel directly to target servers instead of routing through your home living room first.
  3. No Single Point of Failure: If home power or internet flickers while traveling, your mobile devices retain normal internet connectivity.

Traffic Routing Matrix

Traffic Destination Route Taken Network Path & Security
Homelab Services (homelab:2283, :4533, :8000) Tailscale Mesh (100.x.y.z) Point-to-point WireGuard directly to server
Normal Web Browsing (Google, YouTube, News) Local Interface / ProtonVPN Native speed; ProtonVPN privacy & NetShield
BitTorrent Downloads Gluetun Container (Phase 8) Strictly isolated to ProtonVPN WireGuard + kill switch
Untrusted Public Wi-Fi (Hotels / Airports) Optional Tailscale Exit Node On-demand full tunnel back to home network

Running Tailscale and ProtonVPN Simultaneously on Desktop

To prevent routing loops and DNS conflicts on Linux/macOS/Windows: 1. Open the ProtonVPN desktop app. 2. Navigate to Settings → Advanced. 3. Toggle ON "Allow LAN connections" (allows access to local subnets and Carrier-Grade NAT ranges). 4. If strict Kill Switch is enabled, configure Split Tunneling to exclude 100.64.0.0/10 or the Tailscale binary.