Overlapping subnets

When you need sites

Two LANs behind different gateways often use the same subnet — say, 192.168.1.0/24 in two offices or at home and at your parents'. Ordinary subnet routes can't tell them apart: 192.168.1.10 would mean two different hosts. Sites solve this with Tailscale's 4via6: each LAN gets a site number, and a host is reached by its address and the number.

• Host 192.168.1.10 of site 7 is reached by the name 192-168-1-10-via-7 or by its IPv6 address fd7a:115c:a1e0:b1a:0:7:c0a8:10a.
• The same host address at site 8 is 192-168-1-10-via-8 — a different host.
• The gateway of a site is a device of the network inside that LAN; it advertises the site's routes, you approve them, and access rules decide who reaches the site.

Sites live on the Sites tab of the network page, under Sites (overlapping subnets). A site that waits for you — not approved yet, or no access rule opens it — is unfolded; an approved one is a single line: click it for the routes, the command and the host names.

Add a site

Add the gateway to the network first — a Linux device inside the site's LAN works best, since the command is written for it. Then press Add a site and fill in the form:

Press Add site. The site appears with the state not advertised: the gateway doesn't know about it yet.

• Subnets behind one gateway can't overlap — neither within a site nor with the gateway's other sites.
• 100.64.0.0/10 (the network's own addresses), loopback, link-local, multicast and reserved ranges can't be a site's LAN.
• A number is also taken if another device of the network already advertises a 4via6 route with it.

Run the command on the gateway

The site's card shows the command for the gateway, for example:

sudo tailscale set --advertise-routes=fd7a:115c:a1e0:b1a:0:7:c0a8:100/120

• tailscale set keeps the gateway's other settings, the exit node too. If you use tailscale up instead, repeat every flag the gateway was brought up with.
• When the gateway already advertises exactly this list, the card says so — nothing to run.
• If the gateway is offline, the command is built from the routes it advertised when last connected.
• If the gateway advertises 4via6 routes that belong to no site of the network, the card names them: the command stops advertising them.
• The gateway is a subnet router: on Linux it needs IP forwarding.

Approve the site

When the gateway advertises the routes, the state becomes waiting for approval. Press Approve: exactly the site's routes are approved on the gateway, its other approved routes stay. The state turns approved. If you press it too early, the message repeats the command to run first.

Access rules for sites

With visual access rules, devices reach a site only when a rule lets them — without one they don't even get its route. The default Everything rule covers every site, and so does a rule to All subnets once the gateway advertises the site's routes. For a narrower rule, in To pick the site under Sites (4via6), for example “All devices → Site 7 · Web 80, 443”. While no rule covers a site, its card warns about it.

• A rule on the site's IPv4 subnet, like 192.168.1.0/24, doesn't open the site: the site is reached through its 4via6 route. Pick the site itself.
• The table Who can reach whom has a column per subnet of a site, and Check access can test a site too.

Devices must accept routes

Devices that should reach the sites must accept routes — on Linux it's off by default:

sudo tailscale set --accept-routes=true

Reaching hosts at a site

Each site's card has a small calculator: type a host's address into Name and address of a host at this site and press Show. You get:

• the name, like 192-168-1-10-via-7 — use it only like this, without the network's domain: ssh admin@192-168-1-10-via-7, http://192-168-1-10-via-7:8080;
• the IPv6 address, like fd7a:115c:a1e0:b1a:0:7:c0a8:10a, for programs that want an address — in a URL write it in brackets: http://[fd7a:115c:a1e0:b1a:0:7:c0a8:10a]/.

The device table shows a site's routes as “site 7 · 192.168.1.0/24”; the raw IPv6 prefix is in the tooltip and is copied by a click.

Sites with custom HuJSON

If the network uses custom HuJSON, your policy decides who reaches the sites, and it must allow a site by its 4via6 route — a rule on its IPv4 subnet doesn't open it. The policy page lists the hosts to add (one per subnet of a site) and an example rule:

"hosts": {
  "site-7": "fd7a:115c:a1e0:b1a:0:7:c0a8:100/120",
},
"acls": [
  {"action": "accept", "src": ["*"], "dst": ["site-7:*"]},
],

Delete a site

Delete site on the site's card, after a confirmation: its routes stop being approved on the gateway, and access rules that use the site are deleted too. The page then shows a new command for the gateway — its full list of routes without the deleted site; run it so the gateway stops advertising them. With custom HuJSON, remove the site's routes from your policy yourself. When a gateway device is deleted from the network, its sites go with it.

Limits

• A site holds up to 16 subnets; a network holds up to 256 sites.
• Site numbers are 0–65535 and unique within the network.