Subnet routers and exit nodes

What a subnet router is

A device of your private network that also sits in a LAN — at home, in the office — can carry traffic between the mesh and that LAN. Then the other devices of the network reach any host of the LAN by its usual address (a printer, a NAS, a camera, 192.168.1.10) without Tailscale on those hosts.

1. The device advertises the LAN's subnet, e.g. 192.168.1.0/24.
2. You approve the route in the dashboard.
3. The other devices accept routes, and the access rules let them in.

The public network has no subnet routers: there every account reaches only its own devices.

Advertise a subnet

When you add the device

After Add device, above the tabs with commands, fill in the field Subnet to advertise (CIDR, optional) with the LAN's subnet, e.g. 192.168.1.0/24. The commands switch to router mode: --advertise-routes=… instead of --accept-routes, and the Linux tab adds the IP forwarding step.

On a device that is already in the network

printf 'net.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\n' | sudo tee /etc/sysctl.d/99-tailscale.conf && sudo sysctl -e -p /etc/sysctl.d/99-tailscale.conf && sudo tailscale set --advertise-routes=192.168.1.0/24

The first part turns on IP forwarding for good, then tailscale set advertises the subnet. The device's page has this command ready, with the steps around it, under LAN gateway — see LAN gateway.

• Several subnets go in one list, separated by commas. The list replaces the previous one — repeat the subnets you want to keep.
• To route only part of a subnet, advertise just that range: --advertise-routes=192.168.1.0/25. Approval covers exactly the prefix the device advertises.
• On Windows only the tailscale set … part is needed: run it in PowerShell as administrator, without sudo.
• Stop advertising: sudo tailscale set --advertise-routes=.

IP forwarding on Linux

A Linux router must forward packets, and for good. Turn it on before connecting — otherwise tailscale up warns about forwarding disabled, and the subnet's traffic won't flow:

printf 'net.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\n' | sudo tee /etc/sysctl.d/99-tailscale.conf && sudo sysctl -e -p /etc/sysctl.d/99-tailscale.conf

The commands for a gateway on the device's page and on a site's card start with this part. Without it the route is advertised and approved, yet no traffic flows — and the network can't tell, because Tailscale doesn't report it. Check on the router: sysctl net.ipv4.ip_forward must show 1.

Optional, for throughput — if Tailscale warns that UDP GRO is “suboptimally configured”, run once on the host's network interface:

NETDEV=$(ip -o route get 8.8.8.8 | cut -f5 -d" ") && sudo ethtool -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off

Approve routes

An advertised route works only after approval. In the device table the router shows “offers routes →”.

1. Open the device's page and find Routes: every advertised route has a checkbox.
2. Tick the routes to turn on and press Apply. Ticked routes are active and appear in the Routes column of the device table.

With visual access rules, the devices also need a rule that lets them reach the subnet — “All devices → Everything” (the rule a new network starts with) or “… → All subnets” covers it; see Rules for subnets.

Accept routes on the other devices

A device uses the approved subnets only if it accepts routes. The Tailscale apps for Windows, macOS, iOS and Android accept them by default, Linux doesn't. The commands from Add device already include --accept-routes; on a Linux device that joined without it:

sudo tailscale set --accept-routes=true

A Linux device that sits inside the advertised subnet itself may lose direct access to its LAN neighbours once it accepts routes. Keep the LAN going directly:

sudo ip rule add to 192.168.1.0/24 priority 2500 lookup main

High availability: one subnet, two routers

Advertise the same subnet on two devices of the LAN and approve it on both: traffic goes through one, the other stays on hot standby and takes over if the first goes offline. The device table marks such routes with an HA tag; which router is active right now isn't shown. Turn on online/offline tracking for the routers to hear when one drops.

The internet routes of exit nodes are not HA: two exit nodes are two separate choices for a device.

Exit nodes

An exit node carries all internet traffic of the devices that choose it — for example, to go out through your home connection while travelling.

1. On the device that will be the exit — on Linux together with IP forwarding, as on the device's page under Useful node commands:

   printf 'net.ipv4.ip_forward = 1\nnet.ipv6.conf.all.forwarding = 1\n' | sudo tee /etc/sysctl.d/99-tailscale.conf && sudo sysctl -e -p /etc/sysctl.d/99-tailscale.conf && sudo tailscale set --advertise-exit-node

2. On its page under Routes, tick 0.0.0.0/0 and ::/0 (marked exit-node) and press Apply.
3. With visual access rules, the devices need a rule that lets them out to the internet. The default Everything rule already does; if you replaced it, add “… → Internet (exit node)” for the devices that may use the exit, see Internet exit.
4. On a device that should go out through it (the name or the 100.x address of the exit node):

   sudo tailscale set --exit-node=home-server --exit-node-allow-lan-access

   --exit-node-allow-lan-access keeps the device's own LAN reachable. Stop using the exit:

   sudo tailscale set --exit-node=

In the Tailscale apps the exit node is picked from the app's menu.

LAN gateway

Whether a device shares its LAN with the network, and how to make it do so, is on the device's page under LAN gateway, right above Routes:

• The state: the sites the device is the gateway of, and its subnets — each approved or waiting for approval; a site whose routes the device doesn't advertise yet is not advertised.
• Make it a LAN gateway — on a gateway, Commands for the gateway — unfolds the steps: one command turns on IP forwarding for good and advertises the subnet, then you approve the route below, in Routes. On a device that isn't a gateway yet the command has the subnet of its local address — check it; on a gateway it is its whole list of routes, because the list replaces the previous one. The device is already in the network, so no join key is needed.
• On a gateway, a line under the state tells how to check forwarding on it: sysctl net.ipv4.ip_forward must show 1 — without it the route is approved, but no traffic flows.
• The owner and the administrators of the network see the steps; a member sees the state only.

A phone — iOS or Android, as the device itself reports — can't be a LAN gateway, and its page says so in one line. The devices mesh-net adds by itself, like the network's reverse-proxy rp-…, have no such section.

The gateway script for Linux

A subnet router lets the network reach the LAN. The opposite — LAN hosts without Tailscale reaching the network — needs NAT on the gateway. The script in the same section does both and keeps them after a reboot. Run it on a Linux device of this network that sits in the LAN (Tailscale installed and connected, root rights, iptables, systemd):

curl -fsSL https://mesh-net.space/ext/mesh-gateway.sh | sudo sh

No Tailscale on it yet, and tailscale.com doesn't open? Install it from the mesh-net mirror, connect the device to the network, then run the script.

The script asks its questions in a text menu (in Russian) and remembers the answers:

After item 2, the LAN hosts need a route to the mesh through the gateway — on each host, or once as a static route on the LAN router:

ip route add 100.64.0.0/10 via 192.168.1.5

(192.168.1.5 is the gateway's LAN address; the script prints the exact line.) After item 3, approve the route in the dashboard. Later, mesh-gateway.sh --status shows the state without the menu — IP forwarding included.

If a gateway doesn't work

1. The route is approved, but hosts of the LAN don't answer: check IP forwarding on the gateway — sysctl net.ipv4.ip_forward must show 1. If it shows 0, run the command from LAN gateway on the device's page again: it turns forwarding on for good. The network can't see this from its side — Tailscale doesn't report it.
2. The gateway doesn't run with --accept-routes for its own subnet (see A router doesn't accept routes), and the device you connect from accepts routes.
3. The access rules let the device reach the subnet: Check access.

More checks — in A subnet behind a router doesn't answer.

Useful node commands

The same commands are on every device's page under Useful node commands. Run them on the device itself: on Linux and macOS with sudo, on Windows in PowerShell as administrator without it. After changing routes, approve them on the device's page.

The command to advertise subnets is on the same page under LAN gateway (see above): on a gateway — of sites too — with its whole list of routes, because the list replaces the previous one.

Two LANs with the same subnet

Two offices both on 192.168.1.0/24 can't be told apart by ordinary routes. For that, mesh-net has sites — see Overlapping subnets.

Sites work over IPv6. If the devices you connect from have no working IPv6 — another VPN app may block it — map each LAN on its gateway onto a range of its own instead, so that 10.69.0.5 is 192.168.0.5: see Alternative: 1:1 subnet mapping. It works over IPv4 and takes one rule on the gateway.