Networking
Subnet router, site-to-site, exit node or app connector?
The mechanism determines what traffic is routed, which identity represents a resource, where policy is enforced and how legacy networks, sites, internet egress or SaaS destinations connect to the tailnet.
Choose the mechanism based on the use case
Four related terms solve different routing problems.
A native Tailscale node has its own identity and posture data. A device behind a subnet router does not receive its own Tailscale node identity or posture, so segmentation and local-network controls must be designed separately.
Subnet router
- mechanism for devices without the Tailscale client
- advertises selected IP prefixes
- route approval and policy permission are separate
Site-to-site
- a topology built with subnet routers
- routing between selected networks
- SNAT choice, asymmetry and return routes
Exit node
- routes a client's general internet traffic
- use is authorised separately
- egress filtering remains a separate control
App connector
- routes traffic for specified domains
- DNS-derived destination routes can change
- another open internet route can bypass it
Production questions
A route needs an owner, monitoring and a rollback path.
- Which CIDR ranges, domains or internet routes are advertised?
- Who may approve the advertised route, and who may use it?
- How do SNAT, high availability, DNS and return routing work?
- What happens when a router or connector fails?
- How are stale routes withdrawn and a validated configuration restored?
Close bypass paths
Tailscale policy governs tailnet traffic. It does not automatically block a public address, local LAN, cloud-subnet path, Kubernetes network or ordinary internet route. Host, cloud and egress controls must ensure that the intended Tailscale path cannot simply be bypassed.
AIM model
Routing is designed before a connector is installed.
Advice selects the mechanism, trust boundaries, source-address behaviour and high-availability/rollback principles. Integrate implements connectors, routes, DNS and positive and negative tests. Manage maintains routes, keys, approvals and documentation.
