Remote Access to ComfyUI (WSL2 + Docker) over Tailscale

Environment

Why it didn't work out of the box

By default, WSL2 runs inside a lightweight VM behind its own virtual NAT. The distro gets a private IP (e.g. 172.x.x.x) that the rest of the network can't see.

To make life easier, WSL provides localhost forwarding: when something in WSL listens on a port, Windows forwards 127.0.0.1:<port> on the host into the VM. That's why localhost:8188 worked in the host's browser.

The catch: that forwarding is bound to the loopback interface only. When the laptop connects to <tailscale-ip>:8188, the packet arrives on the host's Tailscale interface, not loopback, and nothing is listening there. The connection is refused or times out.

Default NAT mode

Laptop --"<tailscale-ip>:8188"--> Windows Tailscale iface --> x nothing listening (dropped)

Host browser --"localhost:8188"--> Windows loopback --> WSL forwarding --> WSL VM (172.x.x.x) --> comfyui

Mirrored mode

Laptop --"<tailscale-ip>:8188"--> Windows Firewall --> Hyper-V Firewall --> WSL (shares host interfaces) --> comfyui (0.0.0.0:8188)

With mirrored networking, WSL stops using its own NAT and instead shares the host's network interfaces, including the Tailscale one. A service in WSL listening on 0.0.0.0 then listens on the Tailscale IP directly. The only remaining obstacles are the two firewalls.

Prerequisites

• Windows 11 22H2 or newer
• WSL 2.0.0 or newer
• Docker Engine running inside WSL (see Step 0)
• Tailscale installed and logged in on both the Windows host and the laptop
• ComfyUI already reachable at http://localhost:8188 on the host
• An Administrator PowerShell window for the firewall steps

Step 0: Check versions and Docker type

0.1 Check WSL and Windows versions

In PowerShell on the host:

wsl --version

Expected (or newer):

WSL version: 2.7.13.0
Windows version: 10.0.26200.xxxx

Why: mirrored networking needs WSL 2.0.0+ and Windows 11 22H2+ (build 22621+). Build 26200 is 25H2, which is fine. If WSL is older, run wsl --update.

0.2 Identify how Docker is installed

Inside the WSL distro:

docker context ls

Expected for this guide:

NAME        DESCRIPTION                               DOCKER ENDPOINT               ERROR
default *   Current DOCKER_HOST based configuration   unix:///var/run/docker.sock

Why: this decides which path to follow.

Step 1: Enable WSL mirrored networking

1.1 Check for an existing .wslconfig

Get-Content $env:USERPROFILE\.wslconfig

Why: if the file already exists (for example with memory= or processors= limits for an AI workload), you want to add to it, not overwrite it.

• File exists: open it with notepad $env:USERPROFILE\.wslconfig and add networkingMode=mirrored under the existing [wsl2] section.
• File doesn't exist (Cannot find path...): create it as shown below.

1.2 Create the file

Set-Content -Path $env:USERPROFILE\.wslconfig -Value "[wsl2]`nnetworkingMode=mirrored" -Encoding ascii
Get-Content $env:USERPROFILE\.wslconfig

Expected output:

[wsl2]
networkingMode=mirrored

Why this method:

• `n is PowerShell's newline character, so the file ends up with two separate lines.
• -Encoding ascii writes a plain file with no byte-order mark, so the WSL parser has nothing to choke on.
• It avoids Notepad silently saving the file as .wslconfig.txt, which WSL would ignore.

1.3 Restart WSL

wsl --shutdown

Wait about 10 seconds, then open the distro again.

Why: .wslconfig is only read when the WSL VM starts. --shutdown stops the VM completely, so the next launch picks up the new setting. This also stops your containers.

1.4 Verify

Inside WSL:

ip addr | grep "inet 100."

Expected (your own Tailscale IP will differ):

inet <tailscale-ip>/32 brd <tailscale-ip> scope global noprefixroute eth2

Why: seeing the host's Tailscale IP inside WSL proves mirrored mode is active. WSL now shares the host's network interfaces, and eth2 is the mirrored copy of the Tailscale adapter.

docker update --restart unless-stopped comfyui open-webui searxng ollama

Step 2: Verify Docker and ComfyUI bind to all interfaces

Two layers must both accept outside connections:

1. Docker's port mapping: which host interfaces the published port listens on
2. ComfyUI itself: which interfaces the Python server binds to inside the container

Run all three checks inside WSL:

docker ps --format '{{.Names}}  {{.Ports}}'
ss -tlnp | grep 8188
curl -I http://<tailscale-ip>:8188

Expected results

docker ps: the port must be published on 0.0.0.0:

comfyui  0.0.0.0:8188->8188/tcp, [::]:8188->8188/tcp

ss: something must be listening on all interfaces:

LISTEN 0  4096  0.0.0.0:8188  0.0.0.0:*
LISTEN 0  4096     [::]:8188     [::]:*

curl: ComfyUI answers on the Tailscale IP:

HTTP/1.1 200 OK
Server: Python/3.12 aiohttp/3.14.3

Why test from inside WSL first: this curl hits the Tailscale IP without passing through either firewall. If it succeeds, the application side is correct, and any later failure has to be a firewall. Narrowing down one layer at a time makes problems quick to isolate.

docker inspect comfyui --format '{{.Config.Cmd}} {{.Config.Entrypoint}}'

Step 3: Allow the port through Windows Firewall

Open PowerShell as Administrator and run:

New-NetFirewallRule -DisplayName "ComfyUI (Tailscale only)" `
  -Direction Inbound -Protocol TCP -LocalPort 8188 `
  -RemoteAddress 100.64.0.0/10 -Action Allow

Why:

• Windows Firewall blocks unsolicited inbound connections by default.
• -RemoteAddress 100.64.0.0/10 limits the rule to the address block Tailscale assigns to devices (the CGNAT range). Devices on your tailnet can connect. A device on your home Wi-Fi, or on a hotel network if the PC were a laptop, cannot.
• The backticks (`) are PowerShell line continuations, so the command can span several lines.

Step 4: Allow the port through the Hyper-V firewall

In the same Administrator PowerShell:

New-NetFirewallHyperVRule -Name "ComfyUI-Tailscale" -DisplayName "ComfyUI (Tailscale only)" `
  -Direction Inbound -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' `
  -Protocol TCP -LocalPorts 8188 -RemoteAddresses 100.64.0.0/10

Why:

• In mirrored mode, WSL traffic passes through a second firewall, the Hyper-V firewall, which blocks inbound traffic to WSL by default.
• {40E0AC32-46A5-438A-A0B2-2B479E8F2E90} is the fixed ID Windows uses for WSL. The rule applies only to WSL, not to other Hyper-V VMs. (This GUID is the same on every Windows machine — it's a Windows constant, not something specific to your PC.)
• Without this rule the packet gets past the Windows Firewall and is then silently dropped before it reaches WSL. This is the step people most often miss.

Step 5: Test from the laptop

5.1 Confirm the tailnet path

On the laptop:

tailscale status
tailscale ping <pc-name>

Why: tailscale status lists your devices and their names. tailscale ping confirms the two machines can reach each other and shows whether the connection is direct or relayed (DERP). If this fails, the problem is Tailscale itself, not the steps above.

5.2 Test the port

curl -I http://<tailscale-ip>:8188

Expected: HTTP/1.1 200 OK.

5.3 Open it in a browser

• By IP: http://<tailscale-ip>:8188
• By name (MagicDNS enabled): http://<pc-name>:8188

Why MagicDNS is nicer: Tailscale IPs are stable, but names are easier to remember and keep working if you ever re-register the machine.

Exposing other services (optional)

The rules above open only port 8188. To reach another container from the laptop, repeat Steps 3 and 4 with its host port:

Example for Open WebUI:

New-NetFirewallRule -DisplayName "Open WebUI (Tailscale only)" `
  -Direction Inbound -Protocol TCP -LocalPort 3000 `
  -RemoteAddress 100.64.0.0/10 -Action Allow

New-NetFirewallHyperVRule -Name "OpenWebUI-Tailscale" -DisplayName "Open WebUI (Tailscale only)" `
  -Direction Inbound -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' `
  -Protocol TCP -LocalPorts 3000 -RemoteAddresses 100.64.0.0/10

Troubleshooting

Work from the inside out. Each test adds one more layer, so the first test that fails tells you which layer is broken.

[experimental]
hostAddressLoopback=true

Get-NetFirewallHyperVRule -Name "ComfyUI*" | Format-List Name, Direction, Action, LocalPorts, RemoteAddresses

docker update --restart unless-stopped comfyui open-webui searxng ollama

netsh interface portproxy add v4tov4 listenaddress=<tailscale-ip> listenport=8188 connectaddress=127.0.0.1 connectport=8188

Alternative: Tailscale Serve (no firewall changes)

If you'd rather not touch WSL networking or firewalls at all, Tailscale Serve proxies tailnet traffic to the host's own localhost:

1. In the Tailscale admin console, enable MagicDNS and HTTPS Certificates under DNS.
2. In an Administrator PowerShell on the host:

   tailscale serve --bg 8188
   tailscale serve status

   ⎘
3. Open the printed https://<pc-name>.<tailnet>.ts.net URL on the laptop.

Rollback

To undo everything and return to the default setup:

# Remove firewall rules (Admin PowerShell)
Remove-NetFirewallRule -DisplayName "ComfyUI (Tailscale only)"
Remove-NetFirewallHyperVRule -Name "ComfyUI-Tailscale"

# Remove mirrored networking
Remove-Item $env:USERPROFILE\.wslconfig   # or just delete the networkingMode line if the file has other settings
wsl --shutdown

Quick reference

# --- Windows host (Admin PowerShell) ---
Set-Content -Path $env:USERPROFILE\.wslconfig -Value "[wsl2]`nnetworkingMode=mirrored" -Encoding ascii
wsl --shutdown

New-NetFirewallRule -DisplayName "ComfyUI (Tailscale only)" -Direction Inbound -Protocol TCP -LocalPort 8188 -RemoteAddress 100.64.0.0/10 -Action Allow
New-NetFirewallHyperVRule -Name "ComfyUI-Tailscale" -DisplayName "ComfyUI (Tailscale only)" -Direction Inbound -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -Protocol TCP -LocalPorts 8188 -RemoteAddresses 100.64.0.0/10

# --- Inside WSL: verify ---
ip addr | grep "inet 100."
docker ps --format '{{.Names}}  {{.Ports}}'
ss -tlnp | grep 8188
curl -I http://<tailscale-ip>:8188

# --- Laptop: connect ---
tailscale ping <pc-name>
curl -I http://<tailscale-ip>:8188

Key concepts

• WSL2 NAT mode: the default. WSL sits behind a private virtual network, and only localhost is forwarded from Windows.
• Mirrored mode: WSL shares the host's network interfaces, so services on 0.0.0.0 are reachable on every host IP, including Tailscale's.
• 0.0.0.0 vs 127.0.0.1: 0.0.0.0 means "listen on every interface." 127.0.0.1 means "only this machine."
• 100.64.0.0/10: the CGNAT range Tailscale uses for device IPs. Scoping firewall rules to it keeps services tailnet-only.
• Hyper-V firewall: a separate firewall layer for WSL and other VMs, identified by the WSL VMCreatorId {40E0AC32-46A5-438A-A0B2-2B479E8F2E90}.