Skip to main content
A Tailscale Subnet Router on the Network lets every device on your tailnet request private functions by their private names, with no WireGuard peer per device. Set up the router as in the Tailscale Subnet Router Quick Start, in the region of the Network’s DNS resolver. Private names then need two more things on the tailnet: the resolver’s route and split DNS.

​
The Resolver’s Route

The resolver adds its /32 to the advertised routes of every router on the Network, whether the router or the resolver came first. You advertise only the interface subnet:
telnyx-edge network router get pi-demo-ashburn-va-ts then shows both routes under Routes. Approve the /32 on the router’s machine in the Machines page of the admin console, as in Tailscale’s Enable subnet routes from the admin console, and grant access to it as for the interface subnet in the Quick Start. To cover it in advance, add the resolver’s address to the autoApprovers routes and the access rule’s dst. Resolvers currently get addresses in 172.27.240.0/21.

​
Split DNS

Open the DNS page of the Tailscale admin console and add a nameserver under Nameservers:
  • Nameserver: the resolver’s address, 172.27.240.14 here.
  • Restrict to domain: on, with the domain private.telnyxcompute.com.
Tailscale calls this a restricted nameserver, or split DNS, and its guide to route DNS lookups to an internal DNS server shows the same setup. Devices keep their own DNS for every other name. Devices need to accept Tailscale’s DNS settings as well as its routes. macOS, Windows, iOS, and Android do both by default. Linux devices need tailscale set:

​
Request the Function by Name

The function sees the router’s customer_address as the sender, at the start of X-Forwarded-For.

​
Several Networks in One Tailnet

By default, Tailscale sends each route to one primary router, the one that joined the tailnet first, and moves it to another only when that router goes offline. Tailscale calls this active-passive failover. Networks often reuse addresses: a first WireGuard Interface is usually 172.27.0.0/24, and resolvers in different regions can share an address. If routers of two Networks in one tailnet advertise the same route, requests reach whichever router is primary, which may be the other Network.
Route Approval shows how to read which machine serves a route. Give each Network its own interface subnet with telnyx-edge network interface create --subnet. For a shared resolver address, turn the route off on the other router in its Edit route settings, in the Machines page; removing its machine logs that router out for good.

​
Troubleshooting