Tailscale Subnet Router Worksheet (Windows or Linux)
THE TUTORIAL IS MEANT TO BE USED WITH THIS VIDEO!
Before You Start
A free Tailscale account (tailscale.com) - The free Personal plan covers up to 3 users and 100 devices.
The Tailscale app installed on the device you'll test FROM (ex: your phone), signed into the same account.
Admin console: login.tailscale.com you'll approve routes on the Machines page.
Give your subnet router a DHCP reservation on your router, or a static IP, so its IP doesn’t change.
Find your home subnet. Most home networks are 192.168.0.0/24 or 192.168.1.0/24.
On Linux (RPi), run ip -4 addr show
On Windows, run ipconfig. If your device's address is 192.168.1.47, your subnet is 192.168.1.0/24.
My home subnet: ______________________________
(example: 192.168.1.0/24 - use this everywhere you see it below)
Device I want to reach remotely (e.g., NVR) - local IP: ______________________________
Part A - Linux/Raspberry Pi Subnet Router
Works on any Pi running Raspberry Pi OS
Note: A Pi Zero 2W technically works, but Ethernet is recommended because all Tailscale traffic (to a device on the LAN without Tailscale directly installed) will slow down to the connectivity of your subnet router’s LAN connectivity
Run these commands over SSH
A1 - Install Tailscale:
curl -fsSL https://tailscale.com/install.sh | sh
A2 - Enable IP forwarding (permanent):
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf sudo sysctl -p /etc/sysctl.d/99-tailscale.conf
A3 - Bring Tailscale up and advertise your subnet (substitute YOURS from the box above), then open the login URL it prints:
sudo tailscale up --advertise-routes=192.168.1.0/24
A4 - Approve the route: admin console > Machines > your Pi (look for the "Subnets" badge) > three-dot menu > Edit route settings > toggle your subnet ON
A5 - Same three-dot menu > Disable key expiry, so the Pi doesn't silently log out in a few months.
A6 - Other LINUX devices on your tailnet must opt in to routes (phones, Windows, and Mac accept automatically):
sudo tailscale up --accept-routes
A7 - Test: phone on cellular (WiFi OFF), Tailscale connected > open your device's local IP from the box above
Part B - Windows Subnet Router
Best for a PC that's already on 24/7. All commands run in PowerShell opened AS ADMINISTRATOR (right-click Start > Terminal (Admin))
B1 - Install Tailscale for Windows from tailscale.com/download and sign in
B2 - Advertise your subnet:
tailscale up --advertise-routes=192.168.1.0/24
B3 - Enable IP forwarding (registry method), then REBOOT:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" ` -Name "IPEnableRouter" -Value 1
After the reboot, verify with ipconfig /all - you want "IP Routing Enabled : Yes". Alternative (no reboot, per-interface): Set-NetIPInterface -InterfaceAlias "Tailscale" -Forwarding Enabled and the same command again with your LAN adapter's name (find names with Get-NetIPInterface).
B4 - Approve the route: admin console > Machines > your PC > three-dot menu > Edit route settings > toggle your subnet ON. Also Disable key expiry
B5 - Enable unattended mode: Tailscale tray icon > Run unattended. Without this, Tailscale stops when you log out.
B6 - Never sleep: Settings > System > Power > sleep = Never when plugged in, or:
powercfg /change standby-timeout-ac 0
B7 - Test: phone on cellular (WiFi OFF), Tailscale connected > open your device's local IP.
If It Doesn't Work
Can't reach anything: is the route APPROVED in the admin console? Advertising alone does nothing — that's the two-man rule.
Works from phone but not a Linux laptop: that device needs --accept-routes (step A6).
Windows routes nothing: did you reboot after B3? Check ipconfig /all for "IP Routing Enabled : Yes", and confirm unattended mode is on.
Wrong subnet advertised: your LAN might be 192.168.0.x, not 192.168.1.x. Re-run the advertise command with the right one — it replaces the old setting.
Stopped working after months: the machine's key probably expired. Disable key expiry (A5 / B4).
Reolink NVR specifics: disable UID/P2P (NVR fi Network fi Advanced), give the NVR a static IP, then add it in the Reolink app/client BY LOCAL IP
Links
Tailscale subnet router docs: tailscale.com/kb/1019/subnets
IP forwarding: tailscale.com/kb/1104/enable-ip-forwarding
Want to self-host the control server too? headscale: github.com/juanfont/headscale - I'll probably cover this in the upcoming VPS videos
