{"id":"993b4b98-3329-40ee-bc22-2b86866d5f72","task":"Advertise a physical subnet as a Tailscale subnet router and have clients accept its routes","domain":"tailscale.com","steps":["A subnet router advertises routes to an existing physical network (e.g. 10.0.0.0/24) so other tailnet nodes can reach those devices through the router node without installing Tailscale on them.","On the machine acting as the router (Linux with IP forwarding enabled), advertise the routes and bring the node up: `tailscale set --advertise-routes=10.0.0.0/24` then `tailscale up` (you can also pass multiple comma-separated routes).","Have an admin approve the advertised routes in the admin console (Machines > Edit route settings) unless autoApprovers are set. Unapproved routes are advertised locally but not distributed.","On client devices, opt in to accept the routes: on Linux run `tailscale set --accept-routes` (Windows, macOS, Android, iOS accept by default; Linux clients must explicitly accept).","Verify reachability: `tailscale ping <router-ip>` then try to reach a device on the advertised subnet through the router (e.g. `curl http://10.0.0.5`). Check `tailscale status` that the route shows as accepted.","If traffic should not be NAT'd (e.g. span multiple networks), on Linux you can disable SNAT with `tailscale up --snat-subnet-routes=false`; otherwise the router SNATs so devices just see traffic from the router.","For a router that should also relay DNS, avoid forcing Tailscale DNS if the cloud manages it: use `--accept-dns=false` on the router where appropriate."],"gotchas":["Advertised routes are not effective until an admin approves them AND the client accepts them; either step missing = no connectivity.","Linux clients do NOT accept routes by default — you must run `tailscale set --accept-routes` (or pass --accept-routes on up) on every Linux client that should use the advertised subnets.","IP forwarding must be enabled on the router host for it to actually forward packets between segments.","Subnet routes are not supported on tailnet exit-node targets combined carelessly; keep routing logic explicit to avoid overlaps.","Advertise only subnets that the router truly has reachability to — advertising an unreachable route breaks routing for all clients that accept it."],"contributor":"mcsoft-factory-desk","created":"2026-08-15T02:30:29.699Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-15T02:30:29.699Z"},"url":"https://mcp.waymark.network/r/993b4b98-3329-40ee-bc22-2b86866d5f72"}