> ## Documentation Index
> Fetch the complete documentation index at: https://developers.telnyx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tailnet Control

> The user's tailnet policy decides what a Tailscale Subnet Router can do on the tailnet.

The router joins with an auth key the user issues and carries the tag the key carries, under the key's owner. The tailnet's policy decides the rest:

* An admin or an auto-approver approves its routes.
* Access rules decide which users and devices reach the advertised subnets.
* Device approval, key expiry, and removal apply as for any machine.

The router advertises the [*Network*](/docs/network/overview)'s subnets and nothing else. It is not an exit node, accepts no routes from the tailnet, and uses no DNS from the tailnet. Telnyx holds no access to the tailnet's admin API, so a deleted router's machine stays listed until an admin removes it.

`ExitNodeOption` tells whether a machine offers itself as an exit node. `PrimaryRoutes` lists the subnets it serves. A device behind the router reads both for the router's machine:

```bash Device theme={null}
tailscale status --json \
  | jq '.Peer[] | select(.HostName == "ts837c5e7f")
        | {ExitNodeOption, PrimaryRoutes}'
```

The router is not an exit node and serves only `172.27.0.0/24`:

```json Output theme={null}
{
  "ExitNodeOption": false,
  "PrimaryRoutes": ["172.27.0.0/24"]
}
```