Skip to main content
The Tailscale Subnet Router is in beta, with these limits.

​
No Site-to-Site Networking

Flows start only on the tailnet. Site-to-site networking, where hosts on the Network also start flows toward the tailnet, is not available.

​
Network Bindings Are Reached by Address

A function with a network binding is reached by its address, and each deploy moves it to a new one. The old address stops answering when the deploy completes, and the new one answers within about a minute. Look the address up again after each deploy, as in the Quick Start. Private Ingress (Beta) gives a function a stable private name instead, which tailnet devices request through the router: see Tailscale.

​
Network Bindings Keep the Public URL

A function with a network binding keeps its public URL. It answers there and on the Network. A Private Ingress function with private = true has no public URL.

​
One Site, One Revision

A function with a network binding runs at one site, with one revision on the Network at a time.

​
Always Running

A function with a network binding runs one instance at all times. It does not scale to zero, because requests over the Network cannot wake a stopped function.

​
Every Open Port Is Reachable

The Network has no firewall. Every port a function opens is reachable from the Network, and from the devices behind the router that the tailnet policy allows.