> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# One-Way Traffic

> Flows through a Tailscale Subnet Router start on the tailnet. Nothing on the Network starts a flow toward the tailnet.

Flows start from devices behind the router. Replies follow the same flow back. The router accepts no routes from the tailnet and installs no route toward the tailnet on the [*Network*](/docs/network/overview). Nothing on the *Network* can start a flow toward a device behind the router.

A device behind the router calls a function. The function returns the source address it saw, the router's `customer_address`:

```bash Device theme={null}
curl -s http://172.27.0.4:8080/ | jq -r .caller
```

```text Output theme={null}
::ffff:172.27.254.1
```

A host on the *Network* routes the tailnet's range into its tunnel and tries the device's tailnet address, `100.91.239.33`. The connection fails:

```bash Host theme={null}
nc -z -w 3 100.91.239.33 8787; echo "exit $?"
```

```text Output theme={null}
exit 1
```

A capture on the device during the attempt holds no packets from the *Network*:

```bash Device theme={null}
tcpdump -nr tailscale0.pcap | grep -c '172\.27\.'
```

```text Output theme={null}
0
```

## For the Tailnet Admin

* This is Tailscale's default subnet router mode, with [SNAT](https://tailscale.com/docs/features/subnet-routers#disable-snat).