{"slug":"connect-to-an-aws-vpc-using-subnet-routes","title":"Connect to an AWS VPC using subnet routes","tags":["tailscale","routing","setup"],"agent_summary":"Last validated: Dec 4, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Connect to an AWS VPC using subnet routes\r\n\r\nLast validated: Dec 4, 2025\r\n\r\n## [Overview](https://tailscale.com/docs/install/cloud/aws\\#overview)\r\n\r\nThis guide describes steps to deploy a [Tailscale subnet router](https://tailscale.com/docs/features/subnet-routers) to an [Amazon Virtual Private Cloud (Amazon VPC)](https://docs.aws.amazon.com/vpc/index.html) to enable direct access to [Amazon Elastic Compute Cloud (Amazon EC2)](https://docs.aws.amazon.com/ec2) instances running Tailscale. The subnet router enables access to additional Amazon EC2 instances in the Amazon VPC. The deployment takes approximately 15 minutes and is supported in all AWS regions.\r\n\r\nIn the steps below, we'll set up a fresh Amazon VPC with Amazon Managed\r\nNAT Gateway, then configure a Tailscale relay to offer secure access to that\r\nAmazon VPC. We'll create a new Amazon VPC from scratch, but once you're comfortable, you\r\ncan adapt these instructions to set up Tailscale on an existing Amazon VPC.\r\n\r\nThe steps in this guide deploy a single subnet router to a single availability zone. Multiple subnet routers can be deployed across multiple availability zones and configured to advertise the same routes to achieve [high availability failover](https://tailscale.com/docs/how-to/set-up-high-availability).\r\n\r\n## [Prerequisites](https://tailscale.com/docs/install/cloud/aws\\#prerequisites)\r\n\r\n### [Technical requirements](https://tailscale.com/docs/install/cloud/aws\\#technical-requirements)\r\n\r\nTailscale works seamlessly with [Linux](https://tailscale.com/docs/install/linux), [Windows](https://tailscale.com/docs/install/windows), [macOS](https://tailscale.com/docs/install/linux), and more. No database is required and the only storage needed is for the Tailscale node key and node state. You can [configure where node state is stored](https://tailscale.com/docs/reference/tailscaled#flags-to-tailscaled).\r\n\r\n### [Specialized knowledge](https://tailscale.com/docs/install/cloud/aws\\#specialized-knowledge)\r\n\r\nThis guide assumes familiarity with Amazon VPC, Amazon EC2, Linux, and SSH.\r\n\r\n### [Tailscale account](https://tailscale.com/docs/install/cloud/aws\\#tailscale-account)\r\n\r\nIf you don't already have a Tailscale account, create one at [`https://login.tailscale.com/start/`](https://login.tailscale.com/start).\r\n\r\n### [AWS account](https://tailscale.com/docs/install/cloud/aws\\#aws-account)\r\n\r\nIf you don't already have an AWS account, create one at [`https://aws.amazon.com`](https://aws.amazon.com/).\r\n\r\n## [Architecture](https://tailscale.com/docs/install/cloud/aws\\#architecture)\r\n\r\n![Amazon VPC with Tailscale subnet router](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Faws-install.b7fd7e1d.png&w=3840&q=75)\r\n\r\nAs shown in the diagram above, the deployment steps set up the following:\r\n\r\n- An Amazon VPC with public and private subnets, configured with the Amazon VPC Wizard\r\n- In a public subnet, an Amazon EC2 instance running Tailscale as a subnet router\r\n- In a private subnet, an Amazon EC2 instance\r\n\r\nAll devices in a tailnet maintain a connection with the [Tailscale coordination server](https://tailscale.com/docs/reference/glossary#coordination-server) to exchange metadata such as encryption keys, network topology changes, and access policy changes. The coordination server is part of the control plane only, not the data plane—it is not responsible for relaying traffic between devices.\r\n\r\n## [Costs and licenses](https://tailscale.com/docs/install/cloud/aws\\#costs-and-licenses)\r\n\r\nYou will be billed for any AWS services or resources deployed in the steps below. The estimated AWS costs are $100 USD per month.\r\n\r\nTailscale services or resources deployed in the steps below are available in all Tailscale plans, including Personal. For an overview of Tailscale's pricing plans, including paid plans, refer to [Pricing](https://tailscale.com/pricing).\r\n\r\n### [AWS service limits](https://tailscale.com/docs/install/cloud/aws\\#aws-service-limits)\r\n\r\nIf necessary, request [service quota increases](https://console.aws.amazon.com/servicequotas/home?region=us-east-2#!) for the following resources:\r\n\r\n| **Resource** | **This deployment uses** |\r\n| --- | --- |\r\n| VPCs | 1 |\r\n| NAT Gateway | 1 |\r\n| Security groups | 2 |\r\n| EC2 Instances | 2 |\r\n\r\n## [Security considerations](https://tailscale.com/docs/install/cloud/aws\\#security-considerations)\r\n\r\n### [EC2 key pairs](https://tailscale.com/docs/install/cloud/aws\\#ec2-key-pairs)\r\n\r\nMake sure that at least one [Amazon EC2 key pair](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html) exists in your AWS account in the region where you plan to deploy Tailscale. Make note of the key pair name to use in the deployment steps below. To create a key pair, refer to [Amazon EC2 key pairs and Linux instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html). This key will be used to connect to Amazon EC2 instances to install and configure Tailscale.\r\n\r\n### [IAM permissions](https://tailscale.com/docs/install/cloud/aws\\#iam-permissions)\r\n\r\nYou must sign in to the AWS Management Console with IAM permissions to deploy the resources included in this guide. The `AdministratorAccess` managed policy within IAM provides sufficient permissions, although your organization may choose to use a custom policy with more restrictions. For more information, refer to [AWS managed policies for job functions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html).\r\n\r\n## [Deployment steps](https://tailscale.com/docs/install/cloud/aws\\#deployment-steps)\r\n\r\n### [Step 1: Sign in to your AWS account](https://tailscale.com/docs/install/cloud/aws\\#step-1-sign-in-to-your-aws-account)\r\n\r\n[Sign in to your AWS account](https://console.aws.amazon.com/) using an IAM user with the [necessary IAM permissions](https://tailscale.com/docs/install/cloud/aws#iam-permissions). Do not use the AWS account root user for any deployment or operations.\r\n\r\n### [Step 2: Create a VPC](https://tailscale.com/docs/install/cloud/aws\\#step-2-create-a-vpc)\r\n\r\nUse the [**VPC wizard**](https://console.aws.amazon.com/vpc/home#CreateVpc:createMode=vpcWithResources) to create a VPC:\r\n\r\n1. Under **Resources to create** select **VPC and more**.\r\n2. Under **Name tag auto-generation** give your VPC a descriptive name or leave the default value.\r\n3. Under **NAT gateways** select **In 1 AZ**.\r\n4. Select **Create VPC**\r\n\r\n### [Step 3: Create an EC2 instance for the Tailscale subnet router](https://tailscale.com/docs/install/cloud/aws\\#step-3-create-an-ec2-instance-for-the-tailscale-subnet-router)\r\n\r\nUse the [**Launch an instance wizard**](https://console.aws.amazon.com/ec2/home#LaunchInstances:) to create an Amazon EC2 instance:\r\n\r\n1. Under **Application and OS Images** select **Amazon Linux** or another [supported Linux distribution](https://tailscale.com/docs/install/linux).\r\n2. Under **Instance type** select an instance type that meets your computing, memory, networking, or storage needs. A `t2.micro` or any [AWS Free Tier](https://aws.amazon.com/free)-eligible instance type will be sufficient for testing this deployment.\r\n3. Under **Key pair (login)** select a key pair to use for SSH.\r\n4. Under **Network settings** select the VPC you created above.\r\n5. Assign the instance to a public subnet of the VPC, and enable **Auto-assign public IP**.\r\n6. Create a security group and allow Inbound SSH. (We'll need\r\nthis during initial setup, but you can turn it off later.)\r\n7. Name the security group something distinctive, like `tailscale-subnet-router`.\r\n8. Select **Launch instance**.\r\n\r\n### [Step 4: Enable IP forwarding](https://tailscale.com/docs/install/cloud/aws\\#step-4-enable-ip-forwarding)\r\n\r\nIP forwarding is required to use a Linux device as a subnet router. SSH into the EC2 instance and run the commands below.\r\n\r\nIf your Linux system has a `/etc/sysctl.d` directory, use:\r\n\r\n```shell\r\necho 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf\r\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf\r\nsudo sysctl -p /etc/sysctl.d/99-tailscale.conf\r\n```\r\n\r\nOtherwise, use:\r\n\r\n```shell\r\necho 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf\r\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf\r\nsudo sysctl -p /etc/sysctl.conf\r\n```\r\n\r\n### [Step 5: Install Tailscale on your EC2 instance](https://tailscale.com/docs/install/cloud/aws\\#step-5-install-tailscale-on-your-ec2-instance)\r\n\r\nSSH into the EC2 instance and install Tailscale by following [the installation instructions for your distro](https://tailscale.com/docs/install/linux).\r\n\r\nOnce installed, enable the Tailscale systemd service and advertise the desired routes for your subnets:\r\n\r\n```shell\r\nsudo systemctl enable --now tailscaled\r\nsudo tailscale set --advertise-routes=10.0.0.0/24,10.0.1.0/24\r\n```\r\n\r\nYou will be prompted to authenticate the device to your Tailscale network by visiting a link in your browser. Once you're familiar with Tailscale concepts, we recommend using [pre-authentication keys](https://tailscale.com/docs/features/access-control/auth-keys) (\"auth keys\" for short) to register new devices. This is most useful when provisioning devices using infrastructure-as-code systems like AWS CloudFormation.\r\n\r\n`tailscale set --advertise-routes` requires IP forwarding to be enabled. If an error displays about IP forwarding, [follow these steps](https://tailscale.com/docs/reference/troubleshooting/network-configuration/ip-forwarding-errors-advertise).\r\n\r\n### [Step 6: Configure your Tailscale network](https://tailscale.com/docs/install/cloud/aws\\#step-6-configure-your-tailscale-network)\r\n\r\nVisit the Tailscale [admin console](https://login.tailscale.com/admin) and perform the following actions:\r\n\r\n1. [Disable key expiry](https://tailscale.com/docs/features/access-control/key-expiry#disabling-key-expiry) on the subnet router so that you don't need to\r\nreauthenticate the server periodically.\r\n2. Authorize subnet routes on the device, so that Tailscale\r\ndistributes the `10.0.0.0/24` and `10.0.1.0/24` routes to the rest\r\nof your Tailscale network.\r\n\r\n### [Step 7: Verify your connection](https://tailscale.com/docs/install/cloud/aws\\#step-7-verify-your-connection)\r\n\r\nCheck that you can ping the EC2 instance's Tailscale IP address from your\r\npersonal Tailscale device such as Windows and macOS. You can find the Tailscale IP\r\nin the [admin console](https://login.tailscale.com/admin), or by running `tailscale ip -4` on\r\nthe EC2 instance.\r\n\r\n### [Step 8: Close off your firewall](https://tailscale.com/docs/install/cloud/aws\\#step-8-close-off-your-firewall)\r\n\r\nNow that your EC2 instance is available over Tailscale you can disable the open port in your public-facing firewall.\r\n\r\n1. In the [Security Groups panel of the Amazon EC2 console](https://console.aws.amazon.com/ec2/home#SecurityGroups:) find and select the `tailscale-subnet-router` security group.\r\n2. Select **Edit inbound rules** and delete the rule allowing SSH access.\r\n3. Select **Save rules**.\r\n\r\n### [Step 9: Create another EC2 instance to relay to](https://tailscale.com/docs/install/cloud/aws\\#step-9-create-another-ec2-instance-to-relay-to)\r\n\r\nBack in the [**Launch an instance wizard**](https://console.aws.amazon.com/ec2/home#LaunchInstances:) create a second Amazon EC2 instance that we will connect to through the Tailscale subnet router:\r\n\r\n1. Under **Application and OS Images** select **Amazon Linux** or another [supported Linux distribution](https://tailscale.com/docs/install/linux).\r\n2. Under **Instance type** select the same instance type as before.\r\n3. Under **Key pair (login)** select a key pair to use for SSH.\r\n4. Under **Network settings** select the VPC you created above.\r\n5. Assign the instance to a private subnet of the VPC, and leave **Auto-assign public IP** set to **Disable**.\r\n6. Create a security group and allow all traffic inbound from the `tailscale-subnet-router` security group.\r\n7. Select **Launch instance**.\r\n\r\n### [Step 10: Verify your connection](https://tailscale.com/docs/install/cloud/aws\\#step-10-verify-your-connection)\r\n\r\nSSH to your newly created private EC2 instance, using its private\r\nIP. The SSH session will flow through your Tailscale subnet router\r\nand into the private subnet.\r\n\r\n### [Customer responsibility](https://tailscale.com/docs/install/cloud/aws\\#customer-responsibility)\r\n\r\nAfter deployment, confirm that your resources and services are updated and configured—including patching the firmware and operating system of those devices. For more information, refer to the [shared responsibility model](https://tailscale.com/docs/concepts/shared-responsibility).\r\n\r\n### [Support](https://tailscale.com/docs/install/cloud/aws\\#support)\r\n\r\nTailscale offers multiple [support options](https://tailscale.com/docs/reference/support-options) with varying SLAs for response times. [Contact support](https://tailscale.com/contact/support#support-form) if you have any issues related to Tailscale setup or configuration.\r\n\r\n### [Next steps](https://tailscale.com/docs/install/cloud/aws\\#next-steps)\r\n\r\n#### [Server setup](https://tailscale.com/docs/install/cloud/aws\\#server-setup)\r\n\r\nIf you're setting up servers on Tailscale, we recommend you [use an auth key to provision the server, and an tag](https://tailscale.com/docs/how-to/set-up-servers) to restrict its access.\r\n\r\n#### [High availability](https://tailscale.com/docs/install/cloud/aws\\#high-availability)\r\n\r\nMultiple subnet routers can be deployed across multiple availability zones and configured to advertise the same routes to achieve [high availability failover](https://tailscale.com/docs/how-to/set-up-high-availability).\r\n\r\n#### [4via6 subnet routers](https://tailscale.com/docs/install/cloud/aws\\#4via6-subnet-routers)\r\n\r\nIf your network has subnets with overlapping IPv4 addresses, you can use the [4via6 subnet routers](https://tailscale.com/docs/features/subnet-routers/4via6-subnets)\r\nfeature to ensure traffic from each node in your tailnet is routed to the correct device.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Connect to an AWS VPC using subnet routes</h1>\n<p>Last validated: Dec 4, 2025</p>\n<h2><a href=\"https://tailscale.com/docs/install/cloud/aws#overview\">Overview</a></h2>\n<p>This guide describes steps to deploy a <a href=\"https://tailscale.com/docs/features/subnet-routers\">Tailscale subnet router</a> to an <a href=\"https://docs.aws.amazon.com/vpc/index.html\">Amazon Virtual Private Cloud (Amazon VPC)</a> to enable direct access to <a href=\"https://docs.aws.amazon.com/ec2\">Amazon Elastic Compute Cloud (Amazon EC2)</a> instances running Tailscale. The subnet router enables access to additional Amazon EC2 instances in the Amazon VPC. The deployment takes approximately 15 minutes and is supported in all AWS regions.</p>\n<p>In the steps below, we'll set up a fresh Amazon VPC with Amazon Managed\r\nNAT Gateway, then configure a Tailscale relay to offer secure access to that\r\nAmazon VPC. We'll create a new Amazon VPC from scratch, but once you're comfortable, you\r\ncan adapt these instructions to set up Tailscale on an existing Amazon VPC.</p>\n<p>The steps in this guide deploy a single subnet router to a single availability zone. Multiple subnet routers can be deployed across multiple availability zones and configured to advertise the same routes to achieve <a href=\"https://tailscale.com/docs/how-to/set-up-high-availability\">high availability failover</a>.</p>\n<h2><a href=\"https://tailscale.com/docs/install/cloud/aws#prerequisites\">Prerequisites</a></h2>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#technical-requirements\">Technical requirements</a></h3>\n<p>Tailscale works seamlessly with <a href=\"https://tailscale.com/docs/install/linux\">Linux</a>, <a href=\"https://tailscale.com/docs/install/windows\">Windows</a>, <a href=\"https://tailscale.com/docs/install/linux\">macOS</a>, and more. No database is required and the only storage needed is for the Tailscale node key and node state. You can <a href=\"https://tailscale.com/docs/reference/tailscaled#flags-to-tailscaled\">configure where node state is stored</a>.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#specialized-knowledge\">Specialized knowledge</a></h3>\n<p>This guide assumes familiarity with Amazon VPC, Amazon EC2, Linux, and SSH.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#tailscale-account\">Tailscale account</a></h3>\n<p>If you don't already have a Tailscale account, create one at <a href=\"https://login.tailscale.com/start\"><code>https://login.tailscale.com/start/</code></a>.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#aws-account\">AWS account</a></h3>\n<p>If you don't already have an AWS account, create one at <a href=\"https://aws.amazon.com/\"><code>https://aws.amazon.com</code></a>.</p>\n<h2><a href=\"https://tailscale.com/docs/install/cloud/aws#architecture\">Architecture</a></h2>\n<p><img src=\"https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Faws-install.b7fd7e1d.png&#x26;w=3840&#x26;q=75\" alt=\"Amazon VPC with Tailscale subnet router\"></p>\n<p>As shown in the diagram above, the deployment steps set up the following:</p>\n<ul>\n<li>An Amazon VPC with public and private subnets, configured with the Amazon VPC Wizard</li>\n<li>In a public subnet, an Amazon EC2 instance running Tailscale as a subnet router</li>\n<li>In a private subnet, an Amazon EC2 instance</li>\n</ul>\n<p>All devices in a tailnet maintain a connection with the <a href=\"https://tailscale.com/docs/reference/glossary#coordination-server\">Tailscale coordination server</a> to exchange metadata such as encryption keys, network topology changes, and access policy changes. The coordination server is part of the control plane only, not the data plane—it is not responsible for relaying traffic between devices.</p>\n<h2><a href=\"https://tailscale.com/docs/install/cloud/aws#costs-and-licenses\">Costs and licenses</a></h2>\n<p>You will be billed for any AWS services or resources deployed in the steps below. The estimated AWS costs are $100 USD per month.</p>\n<p>Tailscale services or resources deployed in the steps below are available in all Tailscale plans, including Personal. For an overview of Tailscale's pricing plans, including paid plans, refer to <a href=\"https://tailscale.com/pricing\">Pricing</a>.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#aws-service-limits\">AWS service limits</a></h3>\n<p>If necessary, request <a href=\"https://console.aws.amazon.com/servicequotas/home?region=us-east-2#!\">service quota increases</a> for the following resources:</p>\n<p>| <strong>Resource</strong> | <strong>This deployment uses</strong> |\r\n| --- | --- |\r\n| VPCs | 1 |\r\n| NAT Gateway | 1 |\r\n| Security groups | 2 |\r\n| EC2 Instances | 2 |</p>\n<h2><a href=\"https://tailscale.com/docs/install/cloud/aws#security-considerations\">Security considerations</a></h2>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#ec2-key-pairs\">EC2 key pairs</a></h3>\n<p>Make sure that at least one <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html\">Amazon EC2 key pair</a> exists in your AWS account in the region where you plan to deploy Tailscale. Make note of the key pair name to use in the deployment steps below. To create a key pair, refer to <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html\">Amazon EC2 key pairs and Linux instances</a>. This key will be used to connect to Amazon EC2 instances to install and configure Tailscale.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#iam-permissions\">IAM permissions</a></h3>\n<p>You must sign in to the AWS Management Console with IAM permissions to deploy the resources included in this guide. The <code>AdministratorAccess</code> managed policy within IAM provides sufficient permissions, although your organization may choose to use a custom policy with more restrictions. For more information, refer to <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html\">AWS managed policies for job functions</a>.</p>\n<h2><a href=\"https://tailscale.com/docs/install/cloud/aws#deployment-steps\">Deployment steps</a></h2>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-1-sign-in-to-your-aws-account\">Step 1: Sign in to your AWS account</a></h3>\n<p><a href=\"https://console.aws.amazon.com/\">Sign in to your AWS account</a> using an IAM user with the <a href=\"https://tailscale.com/docs/install/cloud/aws#iam-permissions\">necessary IAM permissions</a>. Do not use the AWS account root user for any deployment or operations.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-2-create-a-vpc\">Step 2: Create a VPC</a></h3>\n<p>Use the <a href=\"https://console.aws.amazon.com/vpc/home#CreateVpc:createMode=vpcWithResources\"><strong>VPC wizard</strong></a> to create a VPC:</p>\n<ol>\n<li>Under <strong>Resources to create</strong> select <strong>VPC and more</strong>.</li>\n<li>Under <strong>Name tag auto-generation</strong> give your VPC a descriptive name or leave the default value.</li>\n<li>Under <strong>NAT gateways</strong> select <strong>In 1 AZ</strong>.</li>\n<li>Select <strong>Create VPC</strong></li>\n</ol>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-3-create-an-ec2-instance-for-the-tailscale-subnet-router\">Step 3: Create an EC2 instance for the Tailscale subnet router</a></h3>\n<p>Use the <a href=\"https://console.aws.amazon.com/ec2/home#LaunchInstances:\"><strong>Launch an instance wizard</strong></a> to create an Amazon EC2 instance:</p>\n<ol>\n<li>Under <strong>Application and OS Images</strong> select <strong>Amazon Linux</strong> or another <a href=\"https://tailscale.com/docs/install/linux\">supported Linux distribution</a>.</li>\n<li>Under <strong>Instance type</strong> select an instance type that meets your computing, memory, networking, or storage needs. A <code>t2.micro</code> or any <a href=\"https://aws.amazon.com/free\">AWS Free Tier</a>-eligible instance type will be sufficient for testing this deployment.</li>\n<li>Under <strong>Key pair (login)</strong> select a key pair to use for SSH.</li>\n<li>Under <strong>Network settings</strong> select the VPC you created above.</li>\n<li>Assign the instance to a public subnet of the VPC, and enable <strong>Auto-assign public IP</strong>.</li>\n<li>Create a security group and allow Inbound SSH. (We'll need\r\nthis during initial setup, but you can turn it off later.)</li>\n<li>Name the security group something distinctive, like <code>tailscale-subnet-router</code>.</li>\n<li>Select <strong>Launch instance</strong>.</li>\n</ol>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-4-enable-ip-forwarding\">Step 4: Enable IP forwarding</a></h3>\n<p>IP forwarding is required to use a Linux device as a subnet router. SSH into the EC2 instance and run the commands below.</p>\n<p>If your Linux system has a <code>/etc/sysctl.d</code> directory, use:</p>\n<pre><code class=\"language-shell\">echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf\r\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf\r\nsudo sysctl -p /etc/sysctl.d/99-tailscale.conf\n</code></pre>\n<p>Otherwise, use:</p>\n<pre><code class=\"language-shell\">echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf\r\necho 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.conf\r\nsudo sysctl -p /etc/sysctl.conf\n</code></pre>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-5-install-tailscale-on-your-ec2-instance\">Step 5: Install Tailscale on your EC2 instance</a></h3>\n<p>SSH into the EC2 instance and install Tailscale by following <a href=\"https://tailscale.com/docs/install/linux\">the installation instructions for your distro</a>.</p>\n<p>Once installed, enable the Tailscale systemd service and advertise the desired routes for your subnets:</p>\n<pre><code class=\"language-shell\">sudo systemctl enable --now tailscaled\r\nsudo tailscale set --advertise-routes=10.0.0.0/24,10.0.1.0/24\n</code></pre>\n<p>You will be prompted to authenticate the device to your Tailscale network by visiting a link in your browser. Once you're familiar with Tailscale concepts, we recommend using <a href=\"https://tailscale.com/docs/features/access-control/auth-keys\">pre-authentication keys</a> (\"auth keys\" for short) to register new devices. This is most useful when provisioning devices using infrastructure-as-code systems like AWS CloudFormation.</p>\n<p><code>tailscale set --advertise-routes</code> requires IP forwarding to be enabled. If an error displays about IP forwarding, <a href=\"https://tailscale.com/docs/reference/troubleshooting/network-configuration/ip-forwarding-errors-advertise\">follow these steps</a>.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-6-configure-your-tailscale-network\">Step 6: Configure your Tailscale network</a></h3>\n<p>Visit the Tailscale <a href=\"https://login.tailscale.com/admin\">admin console</a> and perform the following actions:</p>\n<ol>\n<li><a href=\"https://tailscale.com/docs/features/access-control/key-expiry#disabling-key-expiry\">Disable key expiry</a> on the subnet router so that you don't need to\r\nreauthenticate the server periodically.</li>\n<li>Authorize subnet routes on the device, so that Tailscale\r\ndistributes the <code>10.0.0.0/24</code> and <code>10.0.1.0/24</code> routes to the rest\r\nof your Tailscale network.</li>\n</ol>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-7-verify-your-connection\">Step 7: Verify your connection</a></h3>\n<p>Check that you can ping the EC2 instance's Tailscale IP address from your\r\npersonal Tailscale device such as Windows and macOS. You can find the Tailscale IP\r\nin the <a href=\"https://login.tailscale.com/admin\">admin console</a>, or by running <code>tailscale ip -4</code> on\r\nthe EC2 instance.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-8-close-off-your-firewall\">Step 8: Close off your firewall</a></h3>\n<p>Now that your EC2 instance is available over Tailscale you can disable the open port in your public-facing firewall.</p>\n<ol>\n<li>In the <a href=\"https://console.aws.amazon.com/ec2/home#SecurityGroups:\">Security Groups panel of the Amazon EC2 console</a> find and select the <code>tailscale-subnet-router</code> security group.</li>\n<li>Select <strong>Edit inbound rules</strong> and delete the rule allowing SSH access.</li>\n<li>Select <strong>Save rules</strong>.</li>\n</ol>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-9-create-another-ec2-instance-to-relay-to\">Step 9: Create another EC2 instance to relay to</a></h3>\n<p>Back in the <a href=\"https://console.aws.amazon.com/ec2/home#LaunchInstances:\"><strong>Launch an instance wizard</strong></a> create a second Amazon EC2 instance that we will connect to through the Tailscale subnet router:</p>\n<ol>\n<li>Under <strong>Application and OS Images</strong> select <strong>Amazon Linux</strong> or another <a href=\"https://tailscale.com/docs/install/linux\">supported Linux distribution</a>.</li>\n<li>Under <strong>Instance type</strong> select the same instance type as before.</li>\n<li>Under <strong>Key pair (login)</strong> select a key pair to use for SSH.</li>\n<li>Under <strong>Network settings</strong> select the VPC you created above.</li>\n<li>Assign the instance to a private subnet of the VPC, and leave <strong>Auto-assign public IP</strong> set to <strong>Disable</strong>.</li>\n<li>Create a security group and allow all traffic inbound from the <code>tailscale-subnet-router</code> security group.</li>\n<li>Select <strong>Launch instance</strong>.</li>\n</ol>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#step-10-verify-your-connection\">Step 10: Verify your connection</a></h3>\n<p>SSH to your newly created private EC2 instance, using its private\r\nIP. The SSH session will flow through your Tailscale subnet router\r\nand into the private subnet.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#customer-responsibility\">Customer responsibility</a></h3>\n<p>After deployment, confirm that your resources and services are updated and configured—including patching the firmware and operating system of those devices. For more information, refer to the <a href=\"https://tailscale.com/docs/concepts/shared-responsibility\">shared responsibility model</a>.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#support\">Support</a></h3>\n<p>Tailscale offers multiple <a href=\"https://tailscale.com/docs/reference/support-options\">support options</a> with varying SLAs for response times. <a href=\"https://tailscale.com/contact/support#support-form\">Contact support</a> if you have any issues related to Tailscale setup or configuration.</p>\n<h3><a href=\"https://tailscale.com/docs/install/cloud/aws#next-steps\">Next steps</a></h3>\n<h4><a href=\"https://tailscale.com/docs/install/cloud/aws#server-setup\">Server setup</a></h4>\n<p>If you're setting up servers on Tailscale, we recommend you <a href=\"https://tailscale.com/docs/how-to/set-up-servers\">use an auth key to provision the server, and an tag</a> to restrict its access.</p>\n<h4><a href=\"https://tailscale.com/docs/install/cloud/aws#high-availability\">High availability</a></h4>\n<p>Multiple subnet routers can be deployed across multiple availability zones and configured to advertise the same routes to achieve <a href=\"https://tailscale.com/docs/how-to/set-up-high-availability\">high availability failover</a>.</p>\n<h4><a href=\"https://tailscale.com/docs/install/cloud/aws#4via6-subnet-routers\">4via6 subnet routers</a></h4>\n<p>If your network has subnets with overlapping IPv4 addresses, you can use the <a href=\"https://tailscale.com/docs/features/subnet-routers/4via6-subnets\">4via6 subnet routers</a>\r\nfeature to ensure traffic from each node in your tailnet is routed to the correct device.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}