Last updated July 2026.
A Tailscale subnet router allows you to securely access your entire local home network (such as 192.168.1.0/24) from anywhere without installing the Tailscale client on every single device. By enabling IP forwarding on an Ubuntu machine and advertising the route to your Tailnet, you establish a secure, zero-config VPN tunnel that eliminates the need to expose open router ports to the public internet.
Managing remote access to a homelab or home server network traditionally meant setting up dynamic DNS, opening ports on your router, and managing complex reverse proxies. Not only is this setup tedious, but it also exposes your home network to automated port scans and potential vulnerability exploits. Tailscale solves this by establishing a secure, encrypted mesh VPN using the WireGuard protocol. By deploying a Tailscale subnet router, you can bridge your external devices into your home LAN seamlessly, allowing you to access all your self-hosted apps as if you were sitting at home.
Enabling IP Forwarding on Ubuntu
A subnet router acts as a gateway, passing traffic from the Tailscale network interface to your local physical network. For this to work, the host operating system must be configured to forward IPv4 and IPv6 network packets. On Ubuntu, this is done by modifying the kernel parameters in the system configuration.
Editing the /etc/sysctl.conf file to uncomment or add the forwarding flags is the standard method. Once sysctl settings are reloaded, the kernel will allow packets to cross interface boundaries, allowing remote Tailscale traffic to reach your home router and local devices.
Advertising and Approving Subnet Routes
With IP forwarding active, you can launch Tailscale and instruct it to advertise your local IP address ranges (for example, 192.168.1.0/24) to your Tailnet. This tells other devices on your Tailnet that this specific machine can route traffic to those local addresses.
After running the advertisement command, the route remains inactive until an administrator explicitly approves it in the Tailscale admin console. This step ensures that compromise of a single machine cannot automatically bridge networks without administrator consent. Once approved, any device connected to your Tailscale network will automatically route traffic destined for your home LAN through the subnet router.
Frequently Asked Questions
Q: Does setting up a subnet router require port forwarding on my home router?
A: No. Tailscale uses NAT traversal techniques to establish direct, secure outbound connections. You do not need to open any ports or modify firewall configurations on your router.
Q: Can I use a Raspberry Pi as a Tailscale subnet router?
A: Yes. A Raspberry Pi running Raspberry Pi OS or Ubuntu Server makes an excellent, low-power subnet router that can handle standard home network traffic without breaking a sweat.
Q: What happens if multiple subnet routers advertise the same IP range?
A: Tailscale supports high availability and failover. If two subnet routers advertise the same range, Tailscale will automatically route traffic through the primary active router and switch to the backup if it goes offline.
Q: Will remote traffic routed through Tailscale slow down my home network?
A: Only minimally. Because Tailscale uses WireGuard under the hood, the encryption overhead is extremely low. Network latency is primarily determined by the physical distance and internet upload speeds of your home network.