You are away from home. The VPN on your phone is always on, and it is staying on - it is how you reach anything at all from where you are. At home there is a NAS on your Tailscale network: the photos you take all day have nowhere to go, and the films on it are one tap away in theory.

Android gives a phone one VPN slot, and Tailscale’s own FAQ says so plainly. The Tailscale app would take that slot from the VPN you are depending on. The first post in this series covers that problem and the fix: an SSH client whose Tailscale node runs inside the app, as a userspace node, using no VPN service at all.

This post is what you do with it once it is set up. Two jobs, both of which sound like they need the whole phone on the tailnet - and both of which do not.

Disclosure. We build SSH Manager Pro, the Android SSH client used in the walkthrough. The ideas apply to any client that embeds its own Tailscale node; the screens and field names are ours.

What you need

• The app, with its embedded node authorized, and the NAS added as a host (setup is in the first post).
• SSH enabled on the NAS, with a key or password you can log in with.
• MagicDNS on, so the NAS has a name. Short names work (attic-nas); the fully-qualified form is attic-nas.<your-tailnet>.ts.net. Without MagicDNS, use its 100.x.y.z address wherever this post uses the name.
• For the second job, something to watch on the NAS. The example is Jellyfin on its default port 8096; substitute whatever your service listens on.

Job one: photos off the phone, onto the NAS

Nothing here needs the browser, or the tailnet outside the app. The app speaks SFTP over the same connection your terminal uses.

1. Hosts → the NAS’s ⋮ menu → Files. A file browser opens on the NAS.
2. Browse to where you want the photos. Make a folder for the trip if there is not one - the app can create directories as well as upload into them.
3. Upload, then pick the photos from the phone’s picker. You can take a whole folder in one go, not just individual files.
4. Leave it running. Transfers continue in the background with a progress notification, so the phone is not hostage to a slow hotel connection while the originals upload.

The reverse works the same way: download a file from the NAS and it lands on the phone, ready to share from whatever app you like.

A note on what this is not: it is not a background sync service, and it will not watch your camera roll for you. It is a file transfer you start, that then does its job while you get on with your day.

Job two: Jellyfin in the phone’s browser

Here is the part that usually stops people. Your browser cannot see your tailnet - only the app can, because the node lives inside the app. So http://attic-nas:8096 in Chrome goes nowhere, and installing the Tailscale app to fix that is exactly the trade this setup refuses to make.

The way through is a port forward, which turns “the app can reach the NAS” into “the phone can reach the NAS”:

1. Settings → Port Forwards → add one. It is a saved forward, reusable across hosts. Choose Local (the ssh -L direction) and fill it in as:
   • Listen (bind): 127.0.0.1 port 8096
   • Destination: attic-nas port 8096
2. Attach it to the NAS host. Open the host, go to Advanced options, and add the forward to it. Turn on auto-start for that host so you never have to remember it again.
3. Connect the host (or open a session to it). The forward comes up with the session.
4. Open http://127.0.0.1:8096 in any browser on the phone. Jellyfin loads.

That last line is worth a second look, because it is doing something clever: the browser is talking to your own phone. Nothing about it is a network route the system has to know about, so your VPN’s opinion of it does not matter. The path is browser → the app’s loopback port → the tailnet (inside the app) → the NAS.

The same trick covers the NAS’s own admin page, Home Assistant, a router UI, a Grafana dashboard - anything on the tailnet that expects a browser rather than a terminal. One forward per service, each with the local port of your choosing; if something already uses 8096 on the phone, listen on 18096 instead and leave the destination alone.

Two things worth knowing about the shape of it:

• Only what you forward is reachable. The NAS is not suddenly “on the phone”; one port is, for as long as the session runs.
• Nobody else can reach the forwarded port. It listens on 127.0.0.1 - the phone’s own loopback - so it is not exposed to the hotel’s Wi-Fi, your home LAN, or anyone else on the tailnet. Being unreachable from everywhere except the phone is a property worth having in a service you are about to watch films on.

Why your VPN does not come into it

The node is Tailscale’s tsnet library running in the app’s own process: a userspace WireGuard implementation, with no root, no VPN service, and no changes to routes or DNS. It does not compete for the one VPN slot because it does not ask for it, and it does not take the slot when the node starts.

Its traffic is just an app’s traffic, so it travels the way the rest of the phone’s traffic does - through the VPN you already run. Only the app itself can see the tailnet, which is why the port forward above is the trick that makes a browser useful without changing anything about the phone.

A word about networks that are the problem

If you are somewhere the network itself is the obstacle, be clear about what this is: it carries your own traffic to your own machines, over the tunnel you already have. It is not a way around a block, and it does not route anything for the other apps on your phone. If VPNs themselves do not work on the network you are on, no app on top of them fixes that.

If it does not work

• The browser cannot reach 127.0.0.1:8096. The forward only exists while its session is connected - check the app first, then the port number on the phone’s side.
• Jellyfin on a different port. Match the destination port; the local one is yours to choose.
• The name does not resolve. Use the NAS’s 100.x.y.z address as the destination. MagicDNS is the usual culprit.
• Photos crawl. That is the connection, not the app. The transfer keeps going in the background; large videos are worth starting before dinner rather than before bed.

How it works, and where it stops

The node runs inside the app, so the tailnet is reachable inside the app - the terminal, the file browser, and the port forwards it holds open. Everything else on the phone is untouched, VPN slot included. If you want the whole phone on the tailnet - every browser tab, every file manager - the Tailscale app is still the right tool, and this is not a replacement for it.

SSH Manager Pro is on Google Play, and the Tailscale mode is free. Corrections to this post are welcome at support@sshmanagerpro.app.