Decide which forwards can move
Tailscale replaces a port forward when the people using the service can install Tailscale or use a device on your tailnet. It does not replace a forward that has to serve the general public. Sort each forward before touching the router.
Tailscale Funnel is the in-between option. It publishes one local service to the internet through Tailscale's Funnel relay servers, which hide your device's IP address, but it only serves ports 443, 8443 and 10000, only over TLS, only on your tailnet's ts.net name, and is still labeled beta. [7]
| Who uses the service | Typical examples | Where it goes |
|---|---|---|
| Only you | SSH, NAS admin page, remote desktop, router admin | Tailscale; close the forward |
| You plus a few trusted people | Family photo library, home automation dashboard | Tailscale; the Personal plan allows up to 6 users [8] |
| Anyone with a link, over HTTPS | A small personal web page or file drop | Consider Funnel on 443, 8443 or 10000 [7] |
| Anyone, on a custom port or UDP | A public game server | Keep the forward, or host it elsewhere |
Step 1: inventory everything that is open
Forwards hide in three places on a GL.iNet router. Explicit rules are under NETWORK, Port Forwarding, or under SECURITY, Port Forwarding on firmware 4.9 and later. The DMZ setting can send every unmatched port to one host, and if its priority is set higher it overrides all forwarding rules. UPnP, at SECURITY, UPnP (added in firmware 4.11), lets devices create mappings on their own without per-request approval. [1][2]
If your GL.iNet router sits behind an ISP router, repeat the inventory on that device too. Write the results down before changing anything; the table below is a template with fictional rows.
| Description | Protocol | External port | Internal IP and port | Who uses it | Plan |
|---|---|---|---|---|---|
| NAS SSH | TCP | 2222 | 192.168.8.20:22 | Owner | Tailscale |
| NAS web admin | TCP | 5001 | 192.168.8.20:5001 | Owner | Tailscale |
| Camera recorder | TCP | 8443 | 192.168.8.30:443 | Owner and partner | Tailscale |
| DMZ host | All | Unmatched ports | 192.168.8.40 | Nobody remembers | Turn off |
| UPnP mappings | Varies | Varies | Game console | Console | Review, then disable UPnP if unused |
Step 2: put Tailscale on the router or on each host
There are two ways in. A subnet router lets tailnet devices reach LAN addresses that cannot run Tailscale themselves, such as cameras or a printer. Installing Tailscale on each host gives every machine its own tailnet name and address. You can mix both. [4]
On a supported GL.iNet router such as Flint 2, the built-in app is under APPLICATIONS, Tailscale. Turn it on, open the Device Bind Link, sign in, then enable Advertise LAN Subnets (called Allow Remote Access LAN before firmware 4.9). The route does nothing until you approve it in the Tailscale admin console. GL.iNet labels the app beta and advises against running it alongside the router's OpenVPN client, WireGuard client, GoodCloud Site to Site, ZeroTier or AstroWarp. [3]
| Factor | Subnet route on the router | Tailscale on each host |
|---|---|---|
| Reaches devices that cannot run Tailscale | Yes [4] | No |
| Approval step | Approve the route in the admin console [3][4] | Sign in on each device |
| Linux clients | Need the --accept-routes setting to use subnet routes [4] | No extra flag for direct host access |
| Address you type | The device's usual LAN IP, such as 192.168.8.20 | A MagicDNS name or 100.x address [6] |
| Key expiry | Disable it on the subnet router to avoid periodic reauthentication [3][4] | Hosts reauthenticate per your tailnet settings |
Step 3: test from outside while the forwards are still open
Do not close anything yet. Turn Wi-Fi off on a phone so it is on cellular, start Tailscale, and open each service by its new address. For a subnet route, that is the LAN IP from your inventory. For a host install, MagicDNS gives each device a name such as nas.your-tailnet.ts.net; tailnets created on or after October 20, 2022 have MagicDNS on by default. [4][6]
Then tighten access. Tailscale says a new tailnet's default policy lets every device talk to every other device. Before adding a partner or family member, add rules that limit each user to the device and port they need. Rules are directional: letting A reach B does not let B reach A. [5]
- Each service opens over Tailscale from cellular, using the address you plan to bookmark.
- A Linux laptop that uses subnet routes has route acceptance turned on. [4]
- Access rules are in place for anyone besides you. [5]
- The router's DNS is not set to a private-only server if you also use the router as an exit node; GL.iNet warns this can cut internet access. [3]
Step 4: close forwards one at a time
Switch off one rule using its Enable toggle and use the service over Tailscale for a few days. If something breaks, switch the rule back on and find out why. Delete a rule only once its replacement has worked through normal use. [1]
Leave the DMZ and UPnP for last, because they can quietly recreate exposure you thought you had removed. Turn off Enable DMZ if no host needs it. GL.iNet's UPnP page advises enabling UPnP only on trusted networks and turning it off when not needed. [1][2]
Step 5: verify from outside without Tailscale
A closed forward should fail when you are not on the tailnet. Turn Tailscale off on the cellular phone and try your public IP or DDNS name with each old external port. Each should time out or refuse. Turn Tailscale back on and confirm each service still opens by its new address.
Repeat this check after any router firmware update, a factory reset or adding a new smart device. A new device that supports UPnP can create its own mapping if UPnP is still on. [2]
What the free plan covers
Most home migrations fit the Personal plan. Tailscale lists it at $0 for up to 6 users, with unlimited user devices, 50 tagged resources and 3 ACL groups, and says it is not currently enforcing hard limits on some of these quotas. Subnet routers and exit nodes are included. [8]
Questions before you decide
Do devices behind a Tailscale subnet router count toward my plan?
No. Tailscale says devices reached through a subnet router do not count toward your plan's device limit. The Personal plan is free for up to 6 users and Tailscale lists user devices as unlimited on its Personal, Standard and Premium plans.
Is a new tailnet locked down by default?
No. Tailscale says the default policy file for a new tailnet allows communication between all devices in it. If family members or shared devices join, add access rules so each user reaches only the ports they need.
Can people without Tailscale still reach one of my services?
Only through Tailscale Funnel, which is in beta, works over TLS on ports 443, 8443 and 10000, uses your ts.net name and has non-configurable bandwidth limits. Anything else that must be public needs to stay on a forward or another public host.
Should I delete a port forward rule or just disable it?
Disable it first. GL.iNet's port forwarding form has an Enable toggle on each rule, so you can switch a rule off, live with Tailscale access for a while and switch it back on if something breaks, before deleting it.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- GL.iNet Router Docs (firmware 4): Port Forwarding Accessed 30 Oct 2026
- GL.iNet Router Docs (firmware 4): UPnP Accessed 30 Oct 2026
- GL.iNet Router Docs (firmware 4): Tailscale Accessed 30 Oct 2026
- Tailscale Docs: Subnet routers Accessed 30 Oct 2026
- Tailscale Docs: Access control lists Accessed 30 Oct 2026
- Tailscale Docs: MagicDNS Accessed 30 Oct 2026
- Tailscale Docs: Tailscale Funnel Accessed 30 Oct 2026
- Tailscale: Pricing Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.