Subnet routers and exit nodes

What a subnet router is

A device of your private network that also sits in a LAN — at home, in the office — can carry traffic between the mesh and that LAN. Then the other devices of the network reach any host of the LAN by its usual address (a printer, a NAS, a camera, 192.168.1.10) without Tailscale on those hosts.

1. The device advertises the LAN's subnet, e.g. 192.168.1.0/24.
2. You approve the route in the dashboard.
3. The other devices accept routes, and the access rules let them in.

The public network has no subnet routers: there every account reaches only its own devices.

Advertise a subnet

When you add the device

After Add device, above the tabs with commands, fill in the field Subnet to advertise (CIDR, optional) with the LAN's subnet, e.g. 192.168.1.0/24. The commands switch to router mode: --advertise-routes=… instead of --accept-routes, and the Linux tab adds the IP forwarding step.

On a device that is already in the network

sudo tailscale set --advertise-routes=192.168.1.0/24

• Several subnets go in one list, separated by commas. The list replaces the previous one — repeat the subnets you want to keep.
• To route only part of a subnet, advertise just that range: --advertise-routes=192.168.1.0/25. Approval covers exactly the prefix the device advertises.
• On Windows run the command in PowerShell as administrator, without sudo.
• Stop advertising: sudo tailscale set --advertise-routes=.

IP forwarding on Linux

A Linux router must forward packets. Turn it on before connecting — otherwise tailscale up warns about forwarding disabled, and the subnet's traffic won't flow:

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf && echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf && sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

Optional, for throughput — if Tailscale warns that UDP GRO is “suboptimally configured”, run once on the host's network interface:

NETDEV=$(ip -o route get 8.8.8.8 | cut -f5 -d" ") && sudo ethtool -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off

Approve routes

An advertised route works only after approval. In the device table the router shows “offers routes →”.

1. Open the device's page and find Routes: every advertised route has a checkbox.
2. Tick the routes to turn on and press Apply. Ticked routes are active and appear in the Routes column of the device table.

With visual access rules, the devices also need a rule that lets them reach the subnet — “All devices → Everything” (the rule a new network starts with) or “… → All subnets” covers it; see Rules for subnets.

Accept routes on the other devices

A device uses the approved subnets only if it accepts routes. The Tailscale apps for Windows, macOS, iOS and Android accept them by default, Linux doesn't. The commands from Add device already include --accept-routes; on a Linux device that joined without it:

sudo tailscale set --accept-routes=true

A Linux device that sits inside the advertised subnet itself may lose direct access to its LAN neighbours once it accepts routes. Keep the LAN going directly:

sudo ip rule add to 192.168.1.0/24 priority 2500 lookup main

High availability: one subnet, two routers

Advertise the same subnet on two devices of the LAN and approve it on both: traffic goes through one, the other stays on hot standby and takes over if the first goes offline. The device table marks such routes with an HA tag; which router is active right now isn't shown. Turn on online/offline tracking for the routers to hear when one drops.

The internet routes of exit nodes are not HA: two exit nodes are two separate choices for a device.

Exit nodes

An exit node carries all internet traffic of the devices that choose it — for example, to go out through your home connection while travelling.

1. On the device that will be the exit (on Linux with IP forwarding on):

   sudo tailscale set --advertise-exit-node

2. On its page under Routes, tick 0.0.0.0/0 and ::/0 (marked exit-node) and press Apply.
3. With visual access rules, the devices need a rule that lets them out to the internet. The default Everything rule already does; if you replaced it, add “… → Internet (exit node)” for the devices that may use the exit, see Internet exit.
4. On a device that should go out through it (the name or the 100.x address of the exit node):

   sudo tailscale set --exit-node=home-server --exit-node-allow-lan-access

   --exit-node-allow-lan-access keeps the device's own LAN reachable. Stop using the exit:

   sudo tailscale set --exit-node=

In the Tailscale apps the exit node is picked from the app's menu.

Gateway for a whole LAN

A subnet router lets the mesh reach the LAN. The opposite — LAN hosts without Tailscale reaching the mesh — needs a gateway, and the network page has a script for it under Gateway for a whole LAN. Run it on a Linux device of this network that sits in the LAN (Tailscale installed and connected, root rights, iptables, systemd):

curl -fsSL https://mesh-net.space/ext/mesh-gateway.sh | sudo sh

The script asks its questions in a text menu (in Russian) and remembers the answers:

After item 2, the LAN hosts need a route to the mesh through the gateway — on each host, or once as a static route on the LAN router:

ip route add 100.64.0.0/10 via 192.168.1.5

(192.168.1.5 is the gateway's LAN address; the script prints the exact line.) After item 3, approve the route in the dashboard. Later, mesh-gateway.sh --status shows the state without the menu.

Useful node commands

The same commands are on every device's page under Useful node commands. Run them on the device itself: on Linux and macOS with sudo, on Windows in PowerShell as administrator without it. After changing routes, approve them on the device's page.

A device that is the gateway of sites gets its whole list of routes there instead of the single-subnet example, because the list replaces the previous one.

Two LANs with the same subnet

Two offices both on 192.168.1.0/24 can't be told apart by ordinary routes. For that, mesh-net has sites — see Overlapping subnets.