Tailscale subnet and exit node

This example configures an already installed Tailscale client to advertise the router as both a subnet router and an exit node. The YAML contains a TailscaleNode; it does not contain a Package resource that installs Tailscale for you. Install it first (for example, with install.sh --with-tailscale) and follow your tailnet's enrollment procedure.

The complete, validated YAML is in examples/tailscale-exit-subnet.yaml.

Review what remote users can reach

Advertising a subnet route or an exit node can let tailnet users reach a LAN or send their Internet traffic through this router. Use a test tailnet first, protect the auth key, and approve only the intended routes in the Tailscale admin console.

Topology

Diagram map

No.	Meaning	Main resources
[1]	Tailnet that receives route and exit-node advertisements.	External Tailscale control plane
[2]	Router registered as a Tailscale node.	TailscaleNode/home
[3]	LAN prefix advertised to the tailnet.	advertiseRoutes
[4]	Management prefix advertised when remote management is desired.	advertiseRoutes

What this manages

Area	routerd resources
Tailnet node	TailscaleNode/home
Route advertisement	advertiseRoutes
Exit node	advertiseExitNode

Key config

# [2] Register the router as a named Tailscale node.
- apiVersion: net.routerd.net/v1alpha1
  kind: TailscaleNode
  metadata:
    name: home
  spec:
    hostname: edge-router
    advertiseExitNode: true
    # [3] + [4] Prefixes advertised into the tailnet.
    advertiseRoutes:
      - 172.18.0.0/16
      - 192.168.20.0/24
    acceptDNS: false
    authKeyEnv: TS_AUTHKEY
    authKeyFile: /usr/local/etc/routerd/secrets/tailscale.env

Checks

routerd validate --config examples/tailscale-exit-subnet.yaml

workdir=$(mktemp -d)
routerd apply --config examples/tailscale-exit-subnet.yaml --once --dry-run \
  --state-file "$workdir/state.db" \
  --ledger-file "$workdir/ledger.db" \
  --status-file "$workdir/status.json"
rm -rf "$workdir"

Approve the advertised routes and exit-node use in the Tailscale admin console when required by your tailnet policy.