Tailscale Subnet Router: Reach Your Whole LAN Without Installing Tailscale Everywhere (2026)

Tailscale's usual promise is one agent per device. A subnet router is the escape hatch for everything that cannot run an agent: the printer, the NAS with an ancient kernel, the smart TV, the PLC in the workshop. One Linux machine on the LAN advertises the whole local subnet to your tailnet, and every device behind it becomes reachable from anywhere, without touching those devices at all.

What a subnet router actually does

A machine running Tailscale with --advertise-routes tells your tailnet: "traffic for 192.168.1.0/24 can go through me." Tailscale then routes packets from your remote laptop through the encrypted tunnel to that machine, which forwards them onto the LAN like an ordinary gateway, and relays the answers back.

Two consequences follow from that design, and they explain most surprises:

Traffic is masqueraded by default. LAN devices see connections coming from the subnet router's local IP, not from your remote device. That is what lets them answer without knowing anything about Tailscale.

It is not an exit node. A subnet router opens a door into one specific LAN. An exit node routes all your internet traffic through a machine. The two features are configured with different flags and approved separately; if what you want is to browse the internet from your server's IP, you want our Tailscale exit node guide instead.

Setting it up, step by step

The gateway can be anything Linux that is always on. A Raspberry Pi is the classic choice and handles a home LAN's traffic comfortably.

1. Enable IP forwarding. The gateway must be allowed to forward packets between interfaces:

echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

2. Advertise your subnet. Use your LAN's real range; 192.168.1.0/24 is only the most common default:

sudo tailscale up --advertise-routes=192.168.1.0/24

Several subnets can be advertised at once, comma-separated, if the machine can reach them.

3. Approve the routes. This is the step everyone misses, because the command above reports success and yet nothing works. Advertised routes sit pending until an admin approves them in the console: open the machine list at login.tailscale.com/admin/machines, edit the machine's route settings, and enable the advertised subnet. This approval requirement is a security feature, not friction for its own sake: without it, any compromised node could quietly announce itself as the road to your networks.

4. Accept routes on Linux clients. The second missed step. macOS, iOS, Windows and Android clients use approved subnet routes automatically. Linux clients do not, by default:

sudo tailscale set --accept-routes

5. Test honestly. From a device that is genuinely outside the LAN (a phone on mobile data is perfect), reach something that only exists locally: the printer's web page, the NAS's IP. A ping answered from 192.168.1.x across the tunnel is the proof.

One housekeeping note: disable key expiry for the gateway in the admin console, or the whole LAN goes unreachable the day the node's key silently expires.

The overlapping-subnet trap

The single most common real-world failure has nothing to do with Tailscale's software. Your home LAN is 192.168.1.0/24. The hotel Wi-Fi you are sitting on is also 192.168.1.0/24. Your laptop now has two claims on the same addresses, and the local network usually wins: your packets to the NAS go to some stranger's router instead.

The clean fix is to renumber your home LAN once, to something unlikely: a random slice of 10.x.y.0/24 or an uncommon 192.168.x range. Ten minutes in the router's admin page, and the collision class disappears for good. Tailscale also documents the 4via6 mechanism for routing to overlapping subnets by translating them through IPv6, which works but is exactly as much fun as it sounds; renumbering is the option you will not have to think about again.

What to expect, honestly

Performance. Traffic to the LAN makes two hops (tunnel to the gateway, then LAN), and on small hardware the gateway's CPU is the ceiling. For file transfers to a NAS, a Pi tops out well below what the NAS itself could serve; a spare x86 box moves that ceiling out of sight. For printing, dashboards, and administration, anything works.

Availability. As of this writing, subnet routing is available on Tailscale's free plan, and one gateway covers a typical home. Larger setups can run a second subnet router advertising the same routes for failover on paid plans; check Tailscale's current plan page rather than trusting any article, ours included, on pricing details.

Security scope. Approving a subnet route makes the whole range reachable by devices on your tailnet, subject to your access control lists. If only one service matters, a narrower advertised range (down to a single /32) is a cleaner grant than the whole LAN.

Summary

A Tailscale subnet router turns one always-on Linux machine into a door to its entire LAN: enable IP forwarding, advertise the subnet, approve the routes in the admin console, and remember --accept-routes on Linux clients. The two traps that actually bite are the forgotten approval step and overlapping subnets, and the second one is best fixed by renumbering your home network once. For routing all of your traffic rather than reaching one LAN, that is a different feature, and a different guide.