Subnet Routers | Tailscale Explained

Welcome into another episode of Tailscale Explained, I'm Alex. In this series we cover everything you ever wanted to know about Tailscale. Things like Tailscale SSH, serve and funnel and today we're going to cover subnet routers. There'll be a link to the playlist for Tailscale Explained in the description down below and as always I've also put chapter markers down there to help you find the bit of this video that you are looking for. So in today's video we are going to go through the process of setting up a subnet router on Linux and Windows 2 and don't forget you can also use an Apple TV as a subnet router as well. I've put a link to the video I made on that recently up here for you as well. So I should probably start by explaining what a subnet router is, what it does and why you might need one. Wherever possible we recommend installing Tailscale on as many client devices as possible. Installing Tailscale on each client not only allows for the best performance but also end-to-end encryption and routing optimizations between these nodes. Tailscale itself supports a wide range of devices these days, iOS, Android, Linux, Mac, Windows, Amazon Firesticks, we recently added support for those too. But we recognize that not every device allows for a direct installation of Tailscale. Sometimes there are impediments such as organizational policy that prohibits the installation of software and sometimes there are just limitations on the physical devices in question. Maybe they run a closed firmware or simply just aren't powerful enough to run a full networking stack. Just try and imagine Tailscale running on something as simple as a coffee pot, a smart coffee pot for example. Another common use case we hear from our users quite frequently is they already have a network infrastructure configured but they need a quick and easy way to better secure access into and out of that environment. So what they do is they take a subnet router and they throw it into an existing VPC and suddenly they have that whole environment available to the rest of their tailnet. This can include any resource that has a routable IP address from your subnet router node and we see lots of folks using this technique to give their devs or test suites access to remote databases for example. In fact whilst researching this video we heard from a robotics team who installed Tailscale on a Raspberry Pi installed inside one of their robots. They then used that Raspberry Pi as a router to connect to a whole bunch of embedded systems and sensors on that robot using a subnet router. Now maybe you are wanting to remotely access a DNS server or a games console or some other device that can't run Tailscale. That is where a subnet router comes in. A subnet router allows you to install Tailscale on one node in a network and then forward packets from that node out to any other device with an IP address within that subnet and you can do that as if the traffic originated from the subnet router itself. So what do I mean by that exactly? Well when a device connects to a network it gets an IP address and that IP address lives within what's called a subnet. We can think of this a little bit like how we group houses together in the real world using postal codes. The most common subnet size you'll see is what's called a slash 24 in CIDR notation. This is a lazy way of writing the number of bits available for a specific subnet so if you've ever seen something like 255.255.255.0 that means there are 254 IP addresses available in that subnet range. You want to try and keep this number fairly low for performance reasons and 254 is considered the industry standard value for this. So therefore in this example the subnet would start with 192.168.0.1 and end at 192.168.0.254. That is a slash 24. So the general idea with a tailscale subnet router is you would publish the roots for that slash 24 via the tailscale interface and then you're able to access any device in that remote subnet from any other device on your tailnet. So if we come back to that packet rewriting thing for a moment now the tailscale daemon on your subnet router node is receiving a bunch of packets via your tailnet with the destination of a remote subnet coded into them. But how do your tailnet devices know where to send these packets at all? Well that's because these roots are published to every device on your tailnet. That's with a notable caveat here that Linux devices you must pass the accept roots flag in order for Linux hosts to pick up these routes accordingly. The subnet router ingests these packets and then rewrites them and sends them on to the requested destination host. That remote host has no idea you are sending these packets via tailscale. In fact the remote host sees these packets as if they came directly from the subnet router node itself. This is worth considering when designing firewall rules in a restrictive environment for example. Also worth considering is that some people might not want that rewrite to take place. If that's you you probably know it's and we offer an option for you called disabling snat and i'll put a link to that in the description down below. Essentially that basically turns off the rewrite of the origin ip so you can maintain the sanctity of those packets as they get sent through a subnet router. Right so let's walk through the process of setting up a subnet router on windows. I have here a fresh install of windows 11 and i'm going to download tailscale from tailscale.com. So head over to the website and here in the top right hand corner click on the download button followed by download tailscale for windows. Then run the installer that downloads and click on the run button here. Next agree to the license terms and let the installation progress. Once the installation is successfully completed you'll be prompted to log in and i'm going to go ahead and use the google authentication for the tailscale.com tailnet that i always use in these videos and add this desktop node to my tailnet. Once it shows login successful i'm going to go down here to the bottom right hand corner and just verify everything looks like i would expect. I've got all my network devices here all my tag devices preferences i can do things like automatically install updates now or run unattended which tells tailscale to run as a system instead of the currently logged in user. This is useful if you want to keep tailscale running on windows in the background even after you've logged out. So in order to create a subnet router we need to know what the ip range is that we want to publish. Now you can find this out typically most subnets as i say will be a slash 24 mine happens to be a slash 20. Now i'm going to show you in powershell how to find out what your ip address is you just type ipconfig and this shows me here that my ip address for this host is 10.42.7.101 and the default gateway is 0.254. As i say i happen to know that my subnet here is inside the notation that gives me a bit more than those 254 devices we talked about earlier in the video but you can also just type tailscale here you don't have to use the sys tray client in the bottom right hand corner. So we're going to type tailscale set this is how you set parameters for things like exit nodes as well as ssh and in our case subnet routers. So we're going to do tailscale set dash dash advertise routes equals 10.42.0.0 slash 20 and that is going to turn this node into a subnet router for my subnet in this house. Now unless you have auto approvers turned on and check the chapters down below for a little bit more on auto approvers you're going to need to jump over to your tailscale admin console and just click on the three dot menu over here click on edit route settings and then check the box that says the subnet that you just published and once you do that you have successfully configured a subnet router on Windows. It's time to go ahead and get a subnet router set up in Linux. This is a Ubuntu virtual machine and as you can see this is in the subnet 192.168.79.10. I also have another host running at 192.168.79.12 and I want to be able to access both of those from my local laptop using only the Ubuntu node as a subnet router. I'm also going to just show you real quick that I can't actually ping either of these hosts from this laptop right now. So the Ubuntu window is in the remote subnet and this terminal window we're looking at here is on my laptop here. So the objective is to make it so that I can actually ping 79.12 from my local laptop via 79.10. The first thing we need to do is go ahead and install tailscale on the Linux host. You can see tailscale isn't currently installed so I'm going to go to tailscale.com, click on the download button in the top right hand corner and copy the script that we download with curl into my terminal here. This is going to download and install tailscale on Linux for me with no user intervention required. You can see this is now setting up tailscale 1.66.4. The next thing I'm going to do is a pseudo tailscale up. I'm also going to cheat a little bit here and do advertise routes equals 192.168.79.0 slash 24. I'm also going to enable ssh on this node as well. You can do this as part of tailscale up or you can do a tailscale set instead if you would prefer. So this is going to give me a login url. Now I've had to go back to my laptop where I'm actually logged into my tailnet to authorize this device. As usual I go through the sign-in with google procedure and yes I want to connect Ubuntu to my tailnet but in the background you'll see that it updates. I now need to go into edit route settings in the three dot menu in my tailscale admin dashboard. Check the box here which allows traffic to flow through that remote subnet and this should be all we need to do. I'm going to go back to my terminal window that didn't work a few seconds ago and voila! I can now ping 79.10 but I can't ping 79.12 and that's because on Linux we have to enable packet forwarding. But remember I enabled tailscale ssh a few minutes ago. I'm and there you go I'm now connected via ssh to that remote host in the remote subnet. I'll just prove that to you is happening. Look 79.10 it's all looking good. So what I want to do is drop to be root. I'm just going to become root by doing sudo su. Paste in a couple of lines from the tailscale documentation. I'll put a link to that down in the description of course and so now if we try and ping 79.12 from my laptop you'll see that that is now successful. So now we're going to talk briefly about auto approvers. Typically when you enable a subnet route in tailscale you would see this little exclamation mark next to the subnet route that you just wanted to publish and again you'd have to go into root settings and check the box and allow this. In certain situations though you might want to just allow people to do this by default. So I'm just going to reset the advertised routes by passing a pair of quotation marks here. You can see the subnets have just disappeared in my admin console but if you want to allow people to automatically auto approve exit nodes or subnet routers for that matter I have here a little snippet of code that you might find very useful. We can jump over to the tailscale admin page under access controls and add this stanza to our ACLs. I'm just going to click save here and I'll put a snippet to this down in the description as a github repo with all the code snippets from all of our videos here on YouTube. You can see I've now saved the tailnet policy file. So if I go and advertise a route again this time 79.0 and we'll see that the tailscale admin console updates in almost real time but there is no exclamation mark. If we go into the root settings we can see that it was automatically approved. We really have only just scratched the surface with subnet routers in today's video. Didn't even talk about things like bmc ipmi remote access with subnet routers putting these in like a management vlan or something. There's so much more to subnet routers than we could possibly cover in such a short video. Let us know what you're doing with subnet routers down in the comments and be sure to check out the rest of the tailscale explained playlist linked down in the description as well. So until next time thank you so much for watching I've been Alex from Tailscale.