

Two separate functions should go into two separate nodes
- Run Tailscale binary on host. Connect to Jellyfin server using that node’s IP address.
and
- Run Gluetun + another Tailscale instance in containers. Don’t use host networking, use bridge or something else. Connect to that node as an exit node
As an (advanced) alternative to Gluetun + Tailscale I propose tswg (my project)
Is there a way for a Wireguard peer to advertise AllowedIPs similar to Tailscale’s subnet routings? If that’s right, perhaps you can configure your host’s address as one of the AllowedIPs on the OpenWRT peer, and skip port forwarding too