Cross-Region Streaming Bridge

Overview

A Malaysia-based household needed continuous access to Indian streaming services (region-locked to residential Indian IPs) from their home setup overseas. Datacenter VPNs are silently blocked by the streaming providers, so the only viable exit was the family's own home connection in Chennai.

Both endpoints sat behind carrier-grade NAT — Jio CGNAT in India, MEASAT NAT in Malaysia — so direct port forwarding and traditional site-to-site VPN were both off the table. The brief required a working bridge with no infrastructure changes from the carrier and zero ongoing intervention from the client.

Approach

• Userspace Tailscale daemon installed directly onto each UniFi cloud gateway (UCG Ultra in Chennai, UX7 in Malaysia)
• DERP-relayed mesh tunnel — both ends are CGNAT, so traversal is forced through Tailscale's encrypted relay layer rather than direct UDP
• Share-node delegation from operator tailnet to the client's own tailnet — client retains account ownership, operator retains maintenance access
• Persistent auto-start across router reboots via UniFi's /data/on_boot.d/ hook — no manual reconnect ever required
• Key expiry disabled on the long-lived exit node so the link doesn't drop after Tailscale's 6-month refresh
• End-device exit-node routing on a Sony Google TV (Tailscale Android app) — TV traffic egresses Chennai, all other devices stay on the local LAN

Tech Stack

Outcome

The client's TV in Malaysia now streams Indian content through their Chennai residential IP — exactly the same view as if they were at home. Throughput sits at the practical ceiling for a fully-relayed CGNAT-to-CGNAT path (HD streams comfortably; an India-based VPS relay would lift the cap further if 4K becomes a need). Reboot recovery is fully unattended.

The full architecture, install steps, persistence hook, and CGNAT-aware design notes are now reusable as a 30-minute runbook for similar UniFi + geo-bypass cases.