Understand subnet routers

Not every device can run Tailscale. Printers, NAS boxes, managed switches, databases on locked-down appliances, old servers you are not allowed to touch. A subnet router brings a whole IP prefix into the tailnet on their behalf.

Think of your home NAS, a switch’s admin page, or an office printer. No Tailscale client exists for them, or policy forbids installing one. Instead, one Linux machine on that network runs Tailscale and forwards traffic to its neighbors.

How the traffic flows

Your laptop learns a route: “for 192.168.50.0/24, send to the subnet router”. Packets travel encrypted through the tailnet to the router, then hop onto the physical LAN as ordinary local traffic.

The devices behind the router never know Tailscale exists. By default the router applies source NAT, so the printer sees a connection coming from the router’s LAN address, a neighbor it already trusts. Replies go back to the router, which sends them through the tunnel to you.

Reachability is not permission

The route extends reachability. It does not grant permission. Two separate switches control a subnet route:

• route approval decides whether clients learn the route at all. An admin approves the advertised prefix.
• access policy decides who may send traffic into it. A grant names the users and ports.

Approving the route while forgetting the grant, or the reverse, is the most common “it doesn’t work” in this module. When a routed destination times out, check both switches before anything else.

Pick your lab subnet carefully

Choose a disposable private subnet and identify one resource behind it. Then look at your own local network before advertising anything:

ip -4 addr show

2: wlan0    inet 192.168.1.34/24 ...

This laptop sits on 192.168.1.0/24. That is the prefix you must not advertise from a remote site during the first test.

Here is why. If a remote router advertises the same prefix your laptop already uses locally, the client cannot tell local neighbors from routed destinations. The classic symptom: your local printer vanishes while the remote subnet “works”. You spend an hour on it.

Pick something like 192.168.50.0/24 that appears nowhere else in your life. Home routers love 192.168.0.0/24 and 192.168.1.0/24, so avoid those. The next lesson advertises and approves the route for real.