Ragnarr uses normal iOS networking - there is no special VPN mode to configure. The rule of thumb: if a URL opens in Mobile Safari while your VPN is connected, Ragnarr can use the same URL. Compared to exposing services publicly through a reverse proxy, a VPN keeps everything private without certificates, port forwarding or firewall rules.

Tailscale setup

  1. Install the Tailscale iOS app and sign in to the same tailnet as your server.
  2. Confirm your service opens in Mobile Safari using its tailnet hostname, for example http://sonarr.tailnet-name.ts.net:8989 - or https://… if you serve it over TLS.
  3. Add that same URL and API key in Ragnarr.
  4. Tap Test connection before saving.

With MagicDNS enabled, machine names resolve automatically on the tailnet, so you can use short hostnames instead of Tailscale IPs (100.x.y.z). Both work in Ragnarr - hostnames just survive IP changes better.

Keep your local URLs working everywhere

If your services are configured with LAN addresses like http://192.168.1.50:8989, you have two options:

  • Switch the URLs in Ragnarr to the tailnet hostname - works at home and away.
  • Enable a Tailscale subnet router on a machine at home so the 192.168.x.x range is reachable over the tailnet - then the LAN URLs keep working when you are out, without touching your Ragnarr config.

Other VPNs (WireGuard, OpenVPN, …)

Any VPN that gives your iPhone a route to the server works the same way: connect the VPN, verify the URL in Mobile Safari, then use it in Ragnarr. WireGuard users typically use the server's LAN IP or an internal DNS name.

Troubleshooting

  • Check that the VPN is connected before opening Ragnarr - enabling the VPN's on-demand mode avoids surprises.
  • Use the exact URL that works in Safari, including scheme (http:// vs https://) and port.
  • Confirm the service listens on the expected port and path - a 404 often means a missing URL Base segment.
  • If a hostname stopped resolving, check for an expired Tailscale node key on the server and re-authenticate it.
  • An exit node is not required - Ragnarr only needs a route to your services, not full-tunnel routing.

Related guides

Back to all guides, or see the support FAQ for connection troubleshooting.