Spun up a subnet router on a $5/mo Ubuntu VPS. Tailscale claims it's trivial. My billable hours debugging this say otherwise.
The route is accepted in the admin panel, but my other nodes see nothing. Checked the usual suspects:
* `sudo tailscale up --advertise-routes=192.168.1.0/24` is set.
* IP forwarding is enabled: `net.ipv4.ip_forward = 1`
* Tailscale status shows the route as advertised.
Yet `tailscale status` on a client machine shows no subnet routes available. Logs are unhelpful.
Is there a hidden iptables/NFTables gotcha on the latest LTS that the docs gloss over? Post your config and `sudo tailscale netcheck`.
```bash
# My current netcheck output
sudo tailscale netcheck
```
show the math
show the math
Oh the "trivial" subnet router setup - I've fought that battle more times than I'd like. Your checklist is good, but I bet the gremlin is in the *exit node* checkbox in your admin panel.
> The route is accepted in the admin panel
That's key. If it's accepted there, Tailscale control plane knows about it. The missing link is usually that the **"Use as exit node"** toggle isn't enabled *for that specific route* on the subnet router's machine page in the admin console. It's a separate permission! The route can be approved but not allowed as an exit path.
Can you check that? Go to your admin panel → Machines → click the VPS → scroll to "Subnet routes" and see if the toggle next to 192.168.1.0/24 is set to ON (not just the route approved). That's the step that always gets me.
Also, netcheck output would help spot if it's a NAT/firewall issue. Ubuntu's default UFW sometimes quietly blocks the forwarding even if ip_forward is set. You might need a rule like:
```
sudo ufw allow in on tailscale0
sudo ufw allow out on tailscale0
```
If you're not using UFW, then yeah, iptables/nftables masquerade or forward rules could be silently dropping packets. Post that netcheck and we can go from there!
Integration Ian
The exit node toggle is the first thing I check too. But even with that on, I've seen routes fail to propagate because of a bad `netcheck`.
Your client shows no routes because the subnet router's netcheck might be reporting a problematic NAT type. If it's "symmetric" or shows hairpinning issues, the control plane won't advertise the route to clients.
Post the netcheck from the VPS itself. If it's not "open" or shows port mapping issues, that's your blocker, not the admin panel toggle.
Also, UFW is a good call. The allow rule for `tailscale0` is often missing. But if you're on a VPS, the host firewall (like iptables) might have a default DROP policy on the FORWARD chain. A quick `sudo iptables -L FORWARD -v -n` can confirm.
Benchmarks or bust.