# Tailscale
Source: https://docs.gryt.chat/docs/host/tailscale
Play with friends who aren't on your network, without touching your router
Gryt on a LAN needs no setup at all: host a server from the app and everyone on
the same Wi-Fi sees it. The moment one person is somewhere else, you need a route
between the two machines, and that has historically meant a router page nobody
enjoys.
Tailscale is the shortcut. It puts every machine you sign in on into one private
network, whatever building they're in, and Gryt can't tell the difference
between that and a real LAN.
## Why this and not a tunnel
A [Cloudflare Tunnel](https://docs.gryt.chat/docs/host/cloudflare-tunnel) carries HTTPS and the
WebSocket, which is enough for chat and for getting into a server. It can't
carry voice. WebRTC media is UDP, and a tunnel isn't.
Tailscale is WireGuard, which is UDP, so it carries everything: signalling, chat,
uploads and voice, over the same connection. That's the reason this page exists
and the tunnel page doesn't tell you to do this.
## The short version
### Install Tailscale on both machines
[tailscale.com/download](https://tailscale.com/download), and sign in to the
same account on each. That's the whole network setup. Nothing to forward,
nothing to open.
### Host a server in Gryt
The **+** in the server rail, **Create my own**, give it a name, **Create**. It
starts and puts you in it.
Note the port it chose. It's on the server's card under
**Settings → My servers**.
### Find your Tailscale address
```bash
tailscale ip -4
```
Something like `100.101.102.103`. The Tailscale app shows it too. Addresses in
`100.64.0.0/10` are Tailscale's range, and that one is yours on every network
you ever join.
### Have your friend add it
In their Gryt: **+** → **Join a server**, and type your Tailscale address
and port together:
```
100.101.102.103:5001
```
A new server is invite-only, so send them a code from
**Server settings → Invites**.
Invites are the way in here, and they stay the way in. "Allow anyone on LAN to
join" doesn't cover a tailnet: it admits the private ranges, `10.0.0.0/8`,
`172.16.0.0/12`, `192.168.0.0/16` and link-local, and Tailscale hands out
`100.64.0.0/10`, which isn't one of them. Turning that setting on will look
like it has done nothing.
That's chat working. Voice needs one more thing.
## Voice needs the SFU address to be right
Your server tells joining clients where to find the media server. It fills that
in when the server is created, using the address it thinks people will reach you
on. On a laptop that's also on a home network, it picks the home
address: something like `192.168.1.20`. Your friend on Tailscale can't reach
that, so they join fine, chat fine, and hear nothing.
The fix is to list both. Open the server's config:
```
/gryt-servers//config.env
```
`` is `~/Library/Application Support/gryt-chat` on macOS,
`%APPDATA%/gryt-chat` on Windows, `~/.config/gryt-chat` on Linux.
Find `SFU_PUBLIC_HOST` and put your Tailscale address after the existing one,
separated by a comma:
```bash
SFU_PUBLIC_HOST=192.168.1.20:5005,100.101.102.103:5005
```
Both use the SFU port from the same file (`SFU_PORT`), not the server port.
Restart the server from **Settings → My servers** and voice works from
either network: people at home use the first address, people on Tailscale use
the second.
**Keep the home address first.** Gryt corrects a stored SFU address that looks
wrong for the current network, and it treats a Tailscale address in that slot
as one to correct. Leaving the home address at the front means it sees nothing
to fix and leaves the line alone. Put Tailscale first and the next start
overwrites it.
## What doesn't carry over
**Servers don't appear on their own.** LAN discovery works by shouting on the
local link, and that shout doesn't cross a tailnet. Your friend types the
address once; after that it's in their rail like any other server.
**Everyone needs Tailscale running.** It's a private network between machines
signed in to it, so someone who hasn't installed it can't reach your server at
all. That's the trade against a public address: nothing is exposed to the
internet, and nothing works without the client.
**Your machine still has to be awake.** Hosting from the app means the server
stops when Gryt closes. For something that should outlive the session, run it
with [Docker Compose](https://docs.gryt.chat/docs/host/docker-compose) on a machine that stays
on, and put Tailscale on that instead.
## Firewalls
Tailscale routes the traffic, but the operating system still decides whether to
accept it. On Windows the first run usually prompts, and you want to allow it on
private networks. On macOS, hosting a server may prompt for incoming
connections. Deny either and your friend gets a server that never answers.