Tailscale: Exit Nodes and Subnet Routes Compared, and How They Work Technically

A Tailscale node is initially only itself: reachable through its Tailscale address, and nothing else. For a node to give other devices access to more than just itself, there are two operating modes that are often confused: the subnet router and the exit node. Both extend a node’s reach, but in different directions. Those who know the difference can choose the right option and avoid accidentally routing all traffic through another computer.

The short version: A subnet router opens specific IP ranges behind the node, such as the local network with a NAS and printer. An exit node routes a device’s entire internet traffic through itself, like a traditional full-tunnel VPN. Technically, both are based on the same mechanism: advertising routes. The exit node is essentially a special case of the subnet router in which the default route is advertised.

Subnet router: targeted access to a network

A subnet router advertises one or more IP ranges that it can reach on the local network. Other devices in the tailnet that accept these routes can use them to reach devices in the advertised range, even when Tailscale is not installed there. This is the way to make a NAS, printer, or management interface accessible without setting up a VPN client on every individual device.

The range is advertised on the router node:

tailscale set --advertise-routes=192.168.1.0/24

Traffic flows only after the route has been approved in Tailscale administration. Advertising alone is not enough; this is the most common mistake: the route appears in the routing table of devices that accept it only after approval.

Exit node: all traffic through one node

An exit node advertises the default route (0.0.0.0/0 and ::/0). When a device selects this exit node, its entire outgoing internet traffic goes through the node, not just traffic to a particular network. This is useful for accessing the internet through a location with a static IP address or for routing traffic through a trusted exit point on an insecure network.

The difference from a subnet route is the selection on the client side: A subnet route is used automatically as soon as the device accepts the route and addresses a destination in that range. An exit node, by contrast, must be actively selected, and then it applies to all traffic:

tailscale set --exit-node=100.100.10.10 --exit-node-allow-lan-access

That is exactly why it was wrong in day-to-day support to select the exit node for access to a single NAS: it would have redirected all of the user’s traffic through the other computer instead of opening just that one range.

Comparison

How Tailscale implements this technically

Both operating modes are based on the same foundation. It is worth separating the layers.

Data plane through WireGuard. Each node has a WireGuard key pair. The actual traffic between two nodes runs directly as encrypted WireGuard packets over UDP, peer-to-peer after NAT traversal where possible, or through a DERP relay server as a fallback. Tailscale does not reinvent encryption; it uses WireGuard as the transport.

Control plane through the coordination server. A central coordination server distributes the public keys and a network map that records which node has which addresses and routes. The coordination server sees the metadata (who is allowed to talk to whom, which routes are approved), but not the contents of the WireGuard packets. When you advertise a route, the node reports it to the control plane; only after approval does the route become part of the network map received by all nodes.

On the router node. For a node to forward traffic for other devices, it must have IP forwarding enabled and relay packets between the Tailscale interface and the local network. By default, Tailscale masks forwarded traffic with source NAT (SNAT): target devices on the local network see the router node’s local address as the sender, not the Tailscale address of the accessing device. This is the simple case because reply packets automatically find their way back to the router. If you disable SNAT, target devices see the actual Tailscale source address, but the local network must then know how to route the Tailscale range back to the router.

On the client side. A device uses other nodes’ routes only if it accepts them. On the graphical clients for Windows and macOS, accepting subnet routes is enabled by default; on Linux, it is enabled with --accept-routes. When the client accepts a route, it adds it to its routing table and points it to the Tailscale interface. Packets to a destination in this range are then encapsulated in WireGuard and sent to the router node. With an exit node, it is the same mechanism, except the default route points to the exit node, which is why all traffic flows through it.

Approval. Routes taking effect only after approval is a security feature, not an unnecessary detour: an arbitrary node should not be able to attract traffic for entire networks without authorization. Routes can be approved manually in administration or automatically through autoApprovers in access control rules (ACLs). Exit nodes and subnet routes are approved separately.

Limitations

Both options have limitations that affect the choice:

• The router node is a bottleneck and a single point of failure. All traffic for the advertised network passes through this one node, its WireGuard encryption, and its connection. For high availability, multiple nodes can advertise the same route; Tailscale then uses one of them and switches if it fails.
• SNAT hides the source. With the default source NAT, all access appears under the router node’s address. For logging or access rules on target devices that require the actual source, you must disable SNAT and set up the return route on the local network.
• An exit node really routes everything. All traffic passes through the node, with corresponding consequences for throughput, latency, and confidentiality. The exit node operator can see traffic at the point where it leaves the tailnet. Use only nodes you trust as exit nodes.
• Overlapping subnets are a problem. If two locations advertise the same private range, such as 192.168.1.0/24, a client cannot distinguish between them. Tailscale offers IPv6-based translation (4via6) to make the ranges unique.
• Expiring keys stop forwarding. If the router node’s key expires, the entire network behind it is no longer reachable. For a permanent router node, disable key expiry in administration.

For targeted access to internal services, the subnet router is almost always the right choice: it opens only what is needed. Use the exit node when you deliberately want to route all outgoing traffic through a specific location.