Share a local network (gateway)

Bring the local network behind one device into nixscale: advertise routes, approve them in the panel and set up clients.

For:AdminOwnerUpdated September 16, 2026

You can't install Tailscale on everything: printers, NAS boxes, network gear or legacy servers. In that case you make one Linux device on that network a gateway and bring the local network behind it into nixscale. Tailscale calls this a "subnet router"; the panel calls it Networks shared by this device.

How it works

The gateway device advertises the local network it wants to share (for example 192.168.10.0/24).
A network admin approves that network in the panel.
The approved network becomes part of the gateway's label.
The rules written for that label now cover the local network too; you never type a CIDR into a rule.

1. Prepare the gateway

Enable forwarding on Linux:

Terminal

echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
echo 'net.ipv6.conf.all.forwarding = 1' | sudo tee -a /etc/sysctl.d/99-tailscale.conf
sudo sysctl -p /etc/sysctl.d/99-tailscale.conf

2. Advertise the local network

Add the network to share when you connect the device (or by re-running the command while it's connected):

Terminal

sudo tailscale up --login-server=https://k7mp.hs.nixscale.com --authkey=<key> --advertise-routes=192.168.10.0/24

You can pass several networks separated by commas. If the device was connected before with different settings, tailscale up warns you; add --reset to the command.

3. Approve it in the panel

The advertised network appears on the device's row under Networks shared by this device as Awaiting approval. A network admin clicks Approve; to take it back, Revoke.

Approval is a security decision: the moment you approve, that entire local network can become the destination of rules. Pending approvals are also counted in the Needs attention card on the network page.

4. Write the rule and set up clients

Write a rule for the gateway's label; see Access to an office network for an example.

For connected computers to use shared networks:

The macOS client accepts shared networks automatically; no extra setting is needed.

The Linux client does not accept shared networks by default. Add this when connecting:

Terminal

sudo tailscale up --accept-routes

Networks that can't be approved

Case	Why
Invalid network address.	The advertised address isn't a valid CIDR (for example `192.168.1.0/33`).
A route covering the whole internet (0.0.0.0/0) can't be approved — exit nodes are a separate feature.	`0.0.0.0/0` or `::/0` was advertised; a route covering the whole internet is never approved — exit nodes are a separate feature and aren't available today.
This network overlaps the VPN's own address range, which would make routing ambiguous.	The shared network overlaps nixscale's own address range.
The device no longer advertises this network — refresh the list.	The device no longer advertises that network; check the command on the gateway.
You've reached your plan's approved-route limit. Remove an approval or upgrade your plan.	Your plan's limit for approved shared networks has been reached. This limit is per network: each network counts its own approved routes.

Things to watch

If the gateway goes down, the local network behind it becomes unreachable. For critical environments, consider a second gateway.
The shared network's addresses must not clash with the local networks of connecting devices; the same 192.168.1.0/24 in two places makes routing ambiguous.
If the gateway's label changes, the rules are recompiled right away: the shared network moves to the new label's access.
If the gateway is deleted, the path to the shared network goes with it; its leftover entry in the rules is cleared on the next rule change.