Roles Overview

Roles Overview

The gateway joins your tailnet once and can then play several roles. Every role is a switch; all of them start off (rules start disabled, the client access point runs in recovery-only mode).

Role	Direction	Page
Selective Service Gateway	LAN device → one Tailnet TCP/UDP service	Service Gateway
Subnet router	Tailnet clients → your LAN or the AP subnet	Subnet Router
Access-point gateway for IoT	Devices on the gateway's own Wi-Fi → Internet / Tailnet	below
Exit node (use one, or offer one)	Internet via a tailnet peer, or for peers	Exit Node
Remote recovery	Wake-on-LAN plus bounded port checks	Recovery and Wake-on-LAN
Monitoring	Layered connectivity checks and evidence	Monitoring and Health
Automation	MQTT, Home Assistant, ntfy, read-only SNMP	Integrations

Which one do I need?

Need	Use
A few LAN devices must reach one or two remote tailnet services	Service Gateway rules
Tailnet clients must reach your LAN	Subnet router, approved in your tailnet admin
The devices can run a Tailscale client	Install the client on them instead
Isolated IoT devices on their own Wi-Fi	Access-point gateway (with its separate AP-side port forwarding)
Site-wide routing, bulk transfers, video	A router/server-class Tailscale node, not an ESP32

Access-point gateway

Network → Access Point configures the gateway's own Wi-Fi (default subnet 192.168.4.0/24) with DHCP reservations, a client list, a MAC denylist, AP-side port forwarding and an on-board DNS forwarder. The radio is shared with the uplink, so the AP follows the uplink channel. With Enable client access point off (recovery-only), the AP is hidden while the uplink is connected and comes back after 60 s without the saved Wi-Fi. AP clients can reach the tailnet when you advertise the AP subnet (Subnet Router) or use an exit node (Exit Node). Overlapping sites can be mapped with 4via6.

Details: CONFIGURATION.md.