Skip to main content
Flows start from devices behind the router. Replies follow the same flow back. The router accepts no routes from the tailnet and installs no route toward the tailnet on the Network. Nothing on the Network can start a flow toward a device behind the router. A device behind the router calls a function. The function returns the source address it saw, the router’s customer_address:
Device
Output
A host on the Network routes the tailnet’s range into its tunnel and tries the device’s tailnet address, 100.91.239.33. The connection fails:
Host
Output
A capture on the device during the attempt holds no packets from the Network:
Device
Output

​
For the Tailnet Admin

  • This is Tailscale’s default subnet router mode, with SNAT.