Advertise and approve a subnet route

A Linux subnet router must forward packets between its Tailscale and local interfaces.

That is an OS-level capability, and it is off by default. Without it, the route can be advertised, approved, and granted, and every packet still dies inside the router.

Enable IP forwarding

Enable forwarding using the current Tailscale instructions:

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

This persists across reboots because it lives in a sysctl config file, not just in the running kernel.

Advertise the route

Then advertise the exact CIDR with tailscale set:

sudo tailscale set --advertise-routes=192.168.50.0/24
tailscale status

Advertise the narrowest prefix that covers what you need. One database server needs its /32, not the whole office network. Approve the route in the admin console unless an autoApprovers rule covers it. Advertising is a request; approval is the admin’s decision. Once approved, the machine shows a “Subnets” badge in the console.

Add an access grant for the destination prefix before testing:

{
  "src": ["flavio@example.com"],
  "dst": ["192.168.50.0/24"],
  "ip":  ["tcp:80", "tcp:443"]
}

Verify from a client

Linux clients do not accept advertised routes automatically. On your Linux laptop:

sudo tailscale set --accept-routes
curl -m 5 http://192.168.50.20/

Reach one private resource through the route, inspect its observed source address, and document that subnet routing uses SNAT by default. In the destination’s logs you will see the router’s LAN address, not your laptop’s tailnet address. That default keeps LAN devices happy, since replies go to a local neighbor, but it hides the real client. Write it down for whoever reads those logs later.

If the connection times out, work the chain in order: forwarding enabled, route advertised, route approved, grant present, --accept-routes set on the client.