Subnet routes and relay nodes
Tailscale works best when you install Tailscale on every client, server, or VM in your organization. That way, traffic is end-to-end encrypted, and no configuration is needed to move machines between physical locations.
However, you may have machines you don’t want to, or cannot, install Tailscale on directly. In those cases, you can set up a Tailscale “relay node” to advertise whole subnets at once. Relay nodes route all traffic from the Tailscale network onto your physical subnet. This makes it easy to incrementally deploy Tailscale, even on legacy networks.
For example, you can set up a relay node to share an entire AWS VPC with your team, including uncontrolled devices, like RDS servers. You can then set access controls for the VPC by using Access Control Lists (ACLs).
To activate a subnet relay node on a fresh Linux machine, follow these steps:
Step 1: Install the Tailscale client
Download and install Tailscale onto your relay node machine. We offer instructions for a variety of Linux distros.
Step 2: Connect to Tailscale as a relay node
Once installed, you can start (or restart) Tailscale as a relay node:
sudo tailscale up --advertise-routes=10.0.0.0/24,10.0.1.0/24
Replace the subnets in the example above with the right ones for your network. Default routes, 0.0.0.0/0, are not currently supported.
This feature requires IP forwarding to be enabled. If you get an error about
/proc/sys/net/ipv4/ip_forward, you can enable IP forwarding by editing
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf sudo sysctl -p /etc/sysctl.conf
Step 3: Enable subnet routes from the admin console
Visit the admin console, navigate to the machines page, locate your relay node and using the icon at the end of the table, select “Review subnet routes…” This will open up the Subnet settings.
Click “Enable” on your routes so that Tailscale distributes the subnet routes to the rest of the nodes on your Tailscale network.
You may prefer to disable the keys on your server to avoid having to periodically reautenticate. See key expiry for more information about machine keys and how to disable their expiry.
Step 4: Verify your connection
Check that you can ping your new relay node’s Tailscale IP address from your personal Tailscale machine (Windows, macOS, etc). You can find the Tailscale IP in the admin console, or by running this command on the relay node.
sudo ip addr show tailscale0
Step 5: Use your subnet routes from other machines
Clients on Windows, macOS, iOS, and Android will automatically pick up your new subnet routes.
For Linux clients, only those using
--accept-routes flag will discover the
new routes, since the default is to use only the Tailscale 100.x addresses.
Enable this by running:
sudo tailscale up --accept-routes
Updating subnet routes
To later update subnet routes, follow steps 2 to 5 with the new routes.
During step 3 from the admin console, previously enabled routes that you
no longer included in step 2 will now show up with a
Not advertised status. You
can choose to remove the routes completely, or keep them enabled if you plan to
re-advertise them in the future.
Optional: Route DNS lookups to an internal DNS server
You may add Tailscale IPs to public DNS records, since Tailscale IPs are
only accessible to authenticated users of your network. However, if you’d prefer
to use an internal DNS server on your subnet, you can do so by configuring nodes
to use your DNS server on the
For example, on newer versions of Ubuntu, you may use systemd-resolved to route
dev.example.private DNS lookups to your DNS server at
10.1.1.1 like so:
sudo resolvectl dns tailscale0 10.1.1.1 sudo resolvectl domain tailscale0 example.private dev.example.private sudo resolvectl default-route tailscale0 no
These instructions will vary from distro to distro and platform to platform.