Problem

When streaming from outside the home network, Plex logs the Tailscale IP of the VPS as the client IP instead of the real public WAN IP of the person streaming.

Setup

Network path

• VPS – Nginx Proxy Manager (NPM) + CrowdSec, public-facing. Holds the TLS wildcard cert for *.mydomain.com and forces HTTPS.
• Home server – Ubuntu box running Plex bare metal, behind CGNAT (hence the VPS + tunnel).
• Tunnel – VPS ↔ home server over Tailscale. NPM proxies to Plex’s Tailscale IP via MagicDNS (https://plex-server.tailnet.ts.net:32400).

NPM proxy config

Custom config for plex.mydomain.com:

proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions; proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key; proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; gzip on; gzip_vary on; gzip_min_length 1000; gzip_proxied any; gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml; gzip_disable "MSIE [1-6]\."; proxy_redirect off; proxy_buffering off; 

The issue remains even without any custom config.
This default config is applied to all my NPM hosts regardless of custom config:

add_header X-Served-By $host; proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $x_forwarded_scheme; proxy_set_header X-Forwarded-Proto $x_forwarded_proto; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Real-IP $remote_addr; proxy_pass $forward_scheme://$server:$port$request_uri; 

Plex config

• Trusted networks – Tailscale IP of the proxy (100.x.x.x/32) added under Settings → Network → “List of IP addresses and networks that are allowed without auth”. Logs show incoming connections as Request: [100.x.x.x (Allowed Network (Subnet))].
• Custom server access URLs – plex.mydomain.com added for HTTP and HTTPS (http://plex.mydomain.com:80,https://plex.mydomain.com:443)
• Remote Access – disabled by design; the indicator is red. The server is behind CGNAT and reachability is handled entirely via the reverse proxy / Tailscale tunnel, not simple port forwarding.

What’s been confirmed so far

1. Nginx forwards headers correctly – Debug access logs on the VPS confirm X-Forwarded-For / X-Real-IP contain the correct real public IP of the remote client at the point NPM sends the request onward.
2. Plex is not honoring the forwarded header – Plex’s own logs show the connection as coming from the Tailscale subnet IP, not the value in X-Forwarded-For. Verbose logging shows the actual IP (IPv6 in this case): X-Forwarded-For: <REAL_USERS_IPv6>
3. The custom server access URL has no effect – With plex.mydomain.com set as a custom access URL, Plex is reachable from via the correct path but the logs still show the following on remote playback requests: Request came in with unrecognized domain / IP 'plex.mydomain.com' in header Host; treating as non-local
4. Other services work fine – Other services on the same host, proxied through the exact same VPS → NPM → Tailscale → home server chain, correctly displays clients’ real IPs with no extra configuration.

Am I still missing some configuration, or is this just not implemented correctly on Plex’s side?