Subnet Router

Subnet Router

Lets tailnet clients reach devices on a network behind the gateway — the reverse direction of the Service Gateway.

1. Tailscale page → Advertise the AP subnet and/or Additional advertised subnet routes (one CIDR per line, e.g. 192.168.1.0/24). Save; a restart may be required.
2. Approve the routes in the Tailscale admin console or on Headscale. The device cannot see the approval, so its capability list says "route intent".
3. Optional Source-NAT advertised routes: forwarded traffic appears to come from the gateway — useful when LAN devices have no route back to the tailnet, at the cost of hiding the original tailnet client.
4. On clients, accept subnet routes (tailscale up --accept-routes).

Security: every tailnet identity your ACL allows can reach the whole advertised subnet. Prefer narrow prefixes and tailnet ACLs; the gateway's Firewall page adds a second, local filter. Throughput is limited by the ESP32.

Related: Accept peer subnet routes makes the gateway itself use routes advertised by other nodes; 4via6 maps overlapping site subnets.

Full guide: SUBNET-ROUTER.md.