{"slug":"route-traffic","title":"Route traffic","tags":["tailscale","routing"],"agent_summary":"Last validated: Jun 3, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Route traffic\r\n\r\nLast validated: Jun 3, 2025\r\n\r\nUse Tailscale routing features to control how network traffic is routed to, from, and within your Tailscale network, known as a tailnet.\r\n\r\n## [Access non-Tailscale devices](https://tailscale.com/docs/route\\#access-non-tailscale-devices)\r\n\r\nIn cases where you can't install Tailscale on every device on your physical network, you can set up a _subnet router_ to access these devices from your tailnet. Subnet routers respect features like [access control policies](https://tailscale.com/docs/features/access-control), which make it easy to migrate a large network to Tailscale without installing the Tailscale client on every device.\r\n\r\n[**Subnet routers** \\\\\r\n\\\\\r\nUse subnet routers to give devices outside your local network access to services within specific subnets. Extend your private network with Tailscale.](https://tailscale.com/docs/features/subnet-routers)\r\n\r\n## [Route all internet traffic](https://tailscale.com/docs/route\\#route-all-internet-traffic)\r\n\r\nRouting internet traffic through an _exit node_ is useful when accessing untrusted Wi-Fi in a cafe or using an online service (such as banking) only available in your home country from overseas.\r\n\r\nExit nodes route **all** your network traffic, which is often not what you want. To configure Tailscale to only route traffic to certain subnets (the more common configuration), read about [Accessing non-Tailscale devices from your network](https://tailscale.com/docs/route#access-non-tailscale-devices) instead.\r\n\r\n[**Exit nodes (route all traffic)** \\\\\r\n\\\\\r\nRoute all internet traffic through a specific device on your network.](https://tailscale.com/docs/features/exit-nodes) [**Mullvad exit nodes** \\\\\r\n\\\\\r\nUse Mullvad VPN endpoints as exit nodes for your tailnet.](https://tailscale.com/docs/features/exit-nodes/mullvad-exit-nodes)\r\n\r\n## [Control access to third-party applications](https://tailscale.com/docs/route\\#control-access-to-third-party-applications)\r\n\r\nApp connectors let you control device and user access to applications without any end-user setup. They let you manage and monitor access to both SaaS and self-hosted apps across your tailnet.\r\n\r\n[**How app connectors work** \\\\\r\n\\\\\r\nRoute SasS application traffic in your tailnet using app connectors.](https://tailscale.com/docs/features/app-connectors)\r\n\r\n## [Manage DNS](https://tailscale.com/docs/route\\#manage-dns)\r\n\r\nYou can map Tailscale IP addresses to human-readable and memorable names using the Domain Name System (DNS). For example, instead of remembering which IP address maps to an internal expense report server hosted in your tailnet, you can use DNS to map the IP address to the server's name, like \"Expenses\".\r\n\r\n[**DNS in Tailscale** \\\\\r\n\\\\\r\nOptimize your Tailscale network for DNS management, including custom DNS servers, for seamless access and better control.](https://tailscale.com/docs/reference/dns-in-tailscale)\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Route traffic</h1>\n<p>Last validated: Jun 3, 2025</p>\n<p>Use Tailscale routing features to control how network traffic is routed to, from, and within your Tailscale network, known as a tailnet.</p>\n<h2><a href=\"https://tailscale.com/docs/route#access-non-tailscale-devices\">Access non-Tailscale devices</a></h2>\n<p>In cases where you can't install Tailscale on every device on your physical network, you can set up a <em>subnet router</em> to access these devices from your tailnet. Subnet routers respect features like <a href=\"https://tailscale.com/docs/features/access-control\">access control policies</a>, which make it easy to migrate a large network to Tailscale without installing the Tailscale client on every device.</p>\n<p><a href=\"https://tailscale.com/docs/features/subnet-routers\"><strong>Subnet routers</strong> \\\r\n\\\r\nUse subnet routers to give devices outside your local network access to services within specific subnets. Extend your private network with Tailscale.</a></p>\n<h2><a href=\"https://tailscale.com/docs/route#route-all-internet-traffic\">Route all internet traffic</a></h2>\n<p>Routing internet traffic through an <em>exit node</em> is useful when accessing untrusted Wi-Fi in a cafe or using an online service (such as banking) only available in your home country from overseas.</p>\n<p>Exit nodes route <strong>all</strong> your network traffic, which is often not what you want. To configure Tailscale to only route traffic to certain subnets (the more common configuration), read about <a href=\"https://tailscale.com/docs/route#access-non-tailscale-devices\">Accessing non-Tailscale devices from your network</a> instead.</p>\n<p><a href=\"https://tailscale.com/docs/features/exit-nodes\"><strong>Exit nodes (route all traffic)</strong> \\\r\n\\\r\nRoute all internet traffic through a specific device on your network.</a> <a href=\"https://tailscale.com/docs/features/exit-nodes/mullvad-exit-nodes\"><strong>Mullvad exit nodes</strong> \\\r\n\\\r\nUse Mullvad VPN endpoints as exit nodes for your tailnet.</a></p>\n<h2><a href=\"https://tailscale.com/docs/route#control-access-to-third-party-applications\">Control access to third-party applications</a></h2>\n<p>App connectors let you control device and user access to applications without any end-user setup. They let you manage and monitor access to both SaaS and self-hosted apps across your tailnet.</p>\n<p><a href=\"https://tailscale.com/docs/features/app-connectors\"><strong>How app connectors work</strong> \\\r\n\\\r\nRoute SasS application traffic in your tailnet using app connectors.</a></p>\n<h2><a href=\"https://tailscale.com/docs/route#manage-dns\">Manage DNS</a></h2>\n<p>You can map Tailscale IP addresses to human-readable and memorable names using the Domain Name System (DNS). For example, instead of remembering which IP address maps to an internal expense report server hosted in your tailnet, you can use DNS to map the IP address to the server's name, like \"Expenses\".</p>\n<p><a href=\"https://tailscale.com/docs/reference/dns-in-tailscale\"><strong>DNS in Tailscale</strong> \\\r\n\\\r\nOptimize your Tailscale network for DNS management, including custom DNS servers, for seamless access and better control.</a></p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}