Advertise and approve a subnet route

A Linux subnet router has one job: forward packets between its Tailscale interface and its local network interface. That is an OS-level capability, and it is off by default.

Without it, you can advertise the route, approve it, and grant access, and every packet still dies inside the router. So we start there.

Enable IP forwarding

Enable forwarding with the current Tailscale instructions:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

The last command prints the two settings back, which confirms they are active. Because they live in a sysctl config file and not just in the running kernel, they survive a reboot.

Advertise the route

Now advertise the exact CIDR with tailscale set:

sudo tailscale set --advertise-routes=192.168.50.0/24
tailscale status

Advertise the narrowest prefix that covers what you need. One database server needs its /32, not the whole office network. A narrow route is easier to reason about and harder to abuse.

Advertising is a request. Approval is the admin’s decision. Approve the route in the admin console, unless an autoApprovers rule already covers it. Once approved, the machine shows a “Subnets” badge in the Machines list.

Then add an access grant for the destination prefix before testing. Remember the two switches from the previous lesson:

{
  "src": ["[email protected]"],
  "dst": ["192.168.50.0/24"],
  "ip":  ["tcp:80", "tcp:443"]
}

Verify from a client

Linux clients do not accept advertised routes automatically. On your Linux laptop, opt in and then test:

sudo tailscale set --accept-routes
curl -m 5 http://192.168.50.20/

If the web page comes back, the route works end to end. macOS and Windows clients accept routes by default, so on those you can skip the first command.

Now look at the destination’s logs. You will see the router’s LAN address as the source, not your laptop’s tailnet address. That is source NAT at work. It keeps LAN devices happy, since replies go to a local neighbor, but it hides the real client. Write this down for whoever reads those logs later.

When it times out

Work the chain in order: forwarding enabled, route advertised, route approved, grant present, --accept-routes set on the client. Check each one and do not skip ahead. Nine times out of ten the missing piece is the approval or the grant.