{"id":5384,"date":"2026-08-30T17:30:35","date_gmt":"2026-08-30T08:30:35","guid":{"rendered":"https:\/\/donguri3.net\/server-tech\/tailscale-subnet-router-home-access-guide-2\/"},"modified":"2026-08-30T17:30:37","modified_gmt":"2026-08-30T08:30:37","slug":"tailscale-subnet-router-home-access-guide","status":"publish","type":"post","link":"https:\/\/donguri3.net\/en\/server-tech\/linux-server-network\/tailscale-subnet-router-home-access-guide\/","title":{"rendered":"Accessing Home Machines from Outside via Tailscale Subnet Router: IP Forwarding Configuration and Precautions"},"content":{"rendered":"

In PiKVM built with Raspberry Pi 3, Pico, and an ultra-cheap USB capture board \u2013 VPN Monitoring Edition<\/a>, we explained how to introduce Tailscale to PiKVM and securely operate PiKVM itself from remote locations.<\/p>\n

While this dramatically streamlined physical server management, continued operation often increases the need to access “other devices on the home network” located beyond PiKVM.<\/p>\n

Normally, accessing NAS devices that cannot run Tailscale, browser-based network switches, or older PCs from the outside involves the hassle and risks of individual VPN setups or port forwarding. However, by utilizing Tailscale’s “subnet router” feature, it becomes possible to securely integrate the entire home network into the Tailscale mesh via a single device running Tailscale (in this example, PiKVM or a home Linux server). This creates a seamless access environment from outside, making it feel as though you are directly connected to your home Wi-Fi.<\/p>\n

Aiming for Complete Automatic Recovery of the Remote Environment<\/h2>\n

The purpose of this article is to properly configure a Tailscale subnet router and secure a free access path to home devices.<\/p>\n

Particular emphasis is placed on establishing a “robust configuration” where communication is automatically restored without administrator intervention, even after system updates or unexpected power outage reboots, rather than just setting it up and leaving it. For a device intended for remote maintenance, a state where connections drop upon every reboot and require manual command re-entry on-site is incomplete as an infrastructure. We aim to build a stable relay foundation that proves its true value during physical troubles.<\/p>\n

Ensuring Reliable Connectivity and Automation Goals<\/h2>\n

The goals to achieve in this setup are as follows:<\/p>\n

    \n
  1. Reachability to home devices: From a Tailscale device outside, ensure reliable access via browser, SSH, etc., to all target devices within the home LAN (e.g., 192.168.1.0\/24) through the subnet router.<\/li>\n
  2. Complete automatic recovery after reboot: Ensure that when the device reboots after a power loss, the subnet router function is automatically enabled without additional operations, maintaining the external access path.<\/li>\n<\/ol>\n

    By satisfying these conditions, we define a truly “maintenance-free” remote access environment.<\/p>\n

    The Barrier of “IP Forwarding” Blocking Traffic and Admin Console Warnings<\/h2>\n

    When operating a subnet router, the most easily overlooked and crucial point is the configuration of “IP forwarding (ip_forward)” in the Linux kernel.<\/p>\n

    In the Tailscale Admin Console, you might see the error “Unable to relay traffic: This machine has IP forwarding disabled” on the target node. This happens because the Linux OS prohibits “forwarding packets not addressed to itself to other network interfaces.” Linux disables this forwarding function by default for security protection.<\/p>\n

    \"Unable<\/a><\/p>\n

    Furthermore, on dedicated devices like PiKVM (Arch Linux ARM), the file system normally operates in “Read-Only” mode to prevent SD card wear. Even if you enable IP forwarding with a temporary command during testing, without following the proper file-saving procedure, the configuration will reset upon reboot, and the access path into your home will be completely cut off. Understanding and handling both this “OS-level forwarding restriction” and “file system protection specification” is essential.<\/p>\n

    By Environment: Subnet Router Setup and Persistence Procedures<\/h2>\n

    Here are the environment-specific procedures for solving this issue and building a subnet router that operates stably even after a reboot. Check here<\/a> for details.<\/p>\n

    For Standard Linux (Ubuntu, Debian, CentOS, etc.)<\/h3>\n

    When turning a general Linux server into a subnet router, there are no file system restrictions. It is important to correctly create the configuration file (.conf) and have the kernel load it.<\/p>\n

    # 1. Create a configuration file to enable IP forwarding\necho 'net.ipv4.ip_forward = 1' | sudo tee \/etc\/sysctl.d\/99-tailscale.conf\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a \/etc\/sysctl.d\/99-tailscale.conf\n\n# 2. Apply settings immediately\nsudo sysctl -p \/etc\/sysctl.d\/99-tailscale.conf\n\n# 3. Advertise the subnet via Tailscale (e.g., for 192.168.1.0\/24)\nsudo tailscale up --advertise-routes=192.168.1.0\/24<\/pre>\n
    For PiKVM (Arch Linux ARM)<\/h3>\n
    For PiKVM, the procedure involves first disabling write protection to make changes, performing the configuration, and finally re-enabling protection.<\/p>\n
    # 1. Change the file system to Read-Write (RW) mode\nrw\n\n# 2. Create and apply IP forwarding settings (contents are the same as standard Linux)\necho 'net.ipv4.ip_forward = 1' | sudo tee \/etc\/sysctl.d\/99-tailscale.conf\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a \/etc\/sysctl.d\/99-tailscale.conf\nsudo sysctl -p \/etc\/sysctl.d\/99-tailscale.conf\n\n# 3. Advertise the subnet via Tailscale\nsudo tailscale up --advertise-routes=192.168.1.0\/24\n\n# 4. Return the file system to Read-Only (RO) mode\nro<\/pre>\n
    Approval in the Tailscale Admin Console<\/h3>\n
    After running the commands, make sure to access the Tailscale web admin console. From the target node’s “Edit route settings” menu, you need to check the box for the advertised subnet and click “Enable.” Actual traffic relaying will not start until this web-based approval step is completed.<\/p>\n
    Conclusion: Completion of a Highly Reliable Remote Gateway<\/h2>\n
    Tailscale’s subnet router feature is an extremely powerful solution that makes home networks seamlessly accessible across physical distances. However, the key to its operation is none other than the proper configuration of basic Linux network settings: “IP forwarding.”<\/p>\n
    By implementing the persistence settings explained here, you establish a robust access foundation that not only “works now” but also automatically recovers in the event of future failures or power outages. For infrastructure managers, not having to fear unexpected reboots is the greatest peace of mind. After setup, we recommend performing a “reboot test” by restarting the device to verify external access to home machines and confirm that the configuration persists.<\/p>\n","protected":false},"excerpt":{"rendered":"
    In PiKVM built with Raspberry Pi 3, Pico, and an ultra-cheap USB capture board \u2013 VPN Monitoring Edition, we ex […]<\/p>\n","protected":false},"author":4,"featured_media":2832,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"en_US","_original_post":"https:\/\/donguri3.net\/?p=2829","footnotes":""},"categories":[1170],"tags":[105,461,485,352,24,10,310,1042],"class_list":["post-5384","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-server-network","tag-linux","tag-pikvm","tag-tailscale","tag-ubuntu","tag-vpn","tag-server","tag-310","tag-1042","en-US"],"_links":{"self":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/comments?post=5384"}],"version-history":[{"count":1,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5384\/revisions"}],"predecessor-version":[{"id":5387,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5384\/revisions\/5387"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media\/2832"}],"wp:attachment":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media?parent=5384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/categories?post=5384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/tags?post=5384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}