Server guides · Setup
Listen to Audiobookshelf away from home: Tailscale, reverse proxy or Cloudflare Tunnel
Just you? Use Tailscale. Family who won't install a VPN? Use a domain with a reverse proxy and HTTPS, or a Cloudflare Tunnel. How to pick, and the common traps.
If you’re the only listener, install Tailscale on the server and on your phone. If family or friends listen too and won’t install a VPN app, give the server a web address with HTTPS: a domain with a reverse proxy, or a Cloudflare Tunnel.
Audiobookshelf has no relay service like Plex does. Your phone has to reach the server itself, so something has to open a path from the outside world to your home.
Which remote access should I use?
| Tailscale | Domain with a reverse proxy | Cloudflare Tunnel | |
|---|---|---|---|
| Who listens | You, or people who will install Tailscale | Anyone with the address and an account | Anyone with the address and an account |
| Needs an open port on your router | No | Yes (443) | No |
| Needs a domain name | No | Yes, or a free dynamic DNS name | Yes, managed in Cloudflare |
| Cost | Free for personal use | A domain (a yearly fee), or a free dynamic DNS name | A domain; the tunnel is free, but Cloudflare’s terms limit serving large audio files on free plans |
| Setup effort | Low | Medium | Medium |
| Server is visible on the internet | No | Yes | Yes |
The “server is visible” row matters. With a public address, anyone can find your sign-in page, so use strong passwords and keep Audiobookshelf updated. Securing your server covers the rest.
Tailscale: the easy option for just you
Tailscale is a VPN (a private, encrypted link between your devices). Install it on the server and on your iPhone, sign in to the same account on both, and the phone can reach the server from anywhere as if it were at home. Nothing is opened on your router.
In SoundLeaf, use the server’s Tailscale address with http:// and the port, for example http://100.101.102.103:13378. Plain http is fine here because Tailscale already encrypts the connection. The Tailscale setup guide has the details.
The catch is that Tailscale has to be installed and connected on every phone that listens from outside.
Sharing your Tailscale server with family
Tailscale can share one machine with another person’s Tailscale account. They see only that machine, nothing else on your network. They still need the Tailscale app on their phone, so it doesn’t solve the “won’t install a VPN” problem. See Tailscale’s sharing guide.
Tailscale Funnel: a public address without the app
Funnel publishes one service from your tailnet (your private Tailscale network) to the public internet. Listeners don’t need Tailscale. On the server, run:
tailscale funnel --bg 13378
The server then answers at an HTTPS address like https://your-server.your-tailnet.ts.net. Some things to know, from Tailscale’s Funnel docs:
- It needs MagicDNS and HTTPS turned on for your tailnet. The command walks you through it.
- Public traffic only arrives on ports 443, 8443 or 10000.
- Funnel traffic has bandwidth limits you can’t change.
- Funnel is still marked beta.
Set up a domain with a reverse proxy
A reverse proxy (Caddy, Nginx, Nginx Proxy Manager and others) sits in front of Audiobookshelf, adds HTTPS, and is the only thing the internet talks to. You forward port 443 on your router to the proxy and point a domain at your home’s public IP.
This is the classic setup. Your family types one address, like https://books.example.com, and signs in. The reverse proxy guide has working configs for each proxy. Turn on WebSocket support in the proxy. It’s what lets Audiobookshelf send live updates to the app.
If your home IP changes, a dynamic DNS service keeps the domain pointed at it. Some home storage boxes (NAS), Synology among them, include both dynamic DNS and a reverse proxy.
Cloudflare Tunnel: no open ports
A small program called cloudflared runs next to Audiobookshelf and makes an outgoing connection to Cloudflare. Visitors reach your server through Cloudflare, so you open no ports at home. It also works behind CGNAT (more on that below).
You need a domain whose DNS is managed by Cloudflare. Before you rely on it for audiobooks, read Cloudflare’s terms on serving audio and other large files on its free plans; the Cloudflare Tunnel guide quotes them. That guide also covers setup, the common 502 and 522 errors, and the upload limit.
If you add Cloudflare Access (its sign-in page) in front of the server, apps can’t get through it on their own. SoundLeaf can send a Cloudflare service token with every request; see Cloudflare Access setup.
Why doesn’t remote access work?
My ISP uses CGNAT
With CGNAT (carrier-grade NAT), your internet provider shares one public IP between many homes. Port forwarding can’t work because the address on your router isn’t really yours. One sign: the internet address your router shows doesn’t match what a “what is my IP” site shows. Your provider can confirm it.
Tailscale and Cloudflare Tunnel both work behind CGNAT, because the connection starts from inside your home. A reverse proxy at home does not, unless your ISP gives you a public IP (some do on request).
My ISP blocks the port
Some providers block incoming connections on ports 80 and 443. Same answer as CGNAT: Tailscale or a tunnel.
Use Pangolin without opening ports at home
Pangolin is a self-hosted alternative to Cloudflare Tunnel. You run it on a cheap rented server (a VPS) with a public IP, and a small agent at home connects out to it. It gives you a public HTTPS address without opening ports at home. Pangolin can put its own sign-in page in front of Audiobookshelf. Like Cloudflare Access, that’s a web page an app’s requests can’t fill in. Leave Pangolin’s sign-in off for Audiobookshelf, or add a Bypass Auth rule for it. Audiobookshelf still asks for its own username and password.
The domain doesn’t work inside my house
Your phone is on home Wi-Fi, you type https://books.example.com, and it fails. It works on mobile data. Your router probably doesn’t support NAT loopback (sometimes called hairpinning): sending a request out to your public IP and back into the house.
SoundLeaf solves this with home and away addresses. On your home Wi-Fi it uses the local address, like http://192.168.1.20:13378, and everywhere else it uses the domain. You set them up in Settings > Servers, under your server: turn on Automatic endpoint switching, enter your home Wi-Fi name, and allow location access so SoundLeaf can recognize the network. The other fix is local DNS on your router (split DNS), so the domain points at the server’s local IP inside the house.
Can I use Proton VPN or another privacy VPN to reach my server?
Proton VPN, PIA and similar services send your phone’s traffic out to their servers to hide it. They don’t connect you to your own home. Worse, an iPhone runs only one VPN at a time, so a privacy VPN and Tailscale can’t both be on. Disconnect the privacy VPN and connect Tailscale before you listen, or use a reverse proxy or tunnel that doesn’t need a VPN at all.
Don’t forward port 13378 straight to the internet
Forwarding 13378 on your router sends your password over plain http, unencrypted, across the internet. Anyone who can see the traffic on the way, such as on a shared Wi-Fi network, could read it. Always put HTTPS in front: a reverse proxy, a tunnel or Funnel. Or keep the server private with Tailscale.
What does the listener type into the app?
Each person types the server address, then signs in with their own Audiobookshelf account. The address depends on how you set things up:
| Setup | What they type |
|---|---|
| Tailscale | http://100.x.y.z:13378, or http://your-server:13378 with MagicDNS (Tailscale’s names for your devices) turned on |
| Tailscale Funnel | https://your-server.your-tailnet.ts.net |
| Reverse proxy or Cloudflare Tunnel | https://books.example.com |
Type https:// or http:// on the front so the app doesn’t have to guess. What to type as your server address has more examples. SoundLeaf signs in with your username and password, or with OpenID if your server has it set up. It has no API key login.
Give each person their own Audiobookshelf user, so everyone keeps their own progress.
You may not need remote access at all
If you mostly listen on a commute or a trip, download the books at home before you leave. Downloaded books play with no connection to the server, and your progress goes back to the server when the phone can reach it again. See Listening offline.