Three jobs the router can do
GL.iNet's Tailscale page describes these options. Names changed in firmware 4.9, where Allow Remote Access LAN/WAN became Advertise LAN/WAN Subnets and Run Exit Node and IP Masquerading were added. [1]
| Job | Router option | Extra step required |
|---|---|---|
| Reach printers, NAS or cameras on the home router's LAN from anywhere | Advertise LAN Subnets (Allow Remote Access LAN before 4.9) | Approve the route in the Tailscale admin console [1][2] |
| Send every device on a travel router through home | Custom Exit Nodes, pointing at a home device | That device must run as an exit node and be approved [1] |
| Let the router itself be the exit node for your phone and laptop | Run Exit Node (4.9 and later) | Approve it; GL.iNet suggests disabling key expiry [1] |
| Avoid configuring subnet routes for LAN clients | IP Masquerading (4.9 and later) | LAN client traffic appears from the router's Tailscale IP [1] |
Check model, firmware and memory before you plan
GL.iNet lists Tailscale support from firmware 4.2 on models including GL-MT3000, GL-AXT1800, GL-BE3600, GL-MT6000, GL-A1300 and others, and lists GL-SFT1200 (Opal), GL-MT1300, GL-XE300 and several older models as unsupported. It also notes that some models on 4.2 or later are excluded because of insufficient memory. [1]
Tailscale is also unavailable when a GL.iNet router runs in a non-router mode such as Access Point; GL.iNet lists Tailscale among the features disabled there. [4] If the router is bridged behind an ISP device, plan for router mode or install Tailscale on a different device.
Setup in outline
Tailscale notes that Android, iOS, macOS, tvOS and Windows pick up new subnet routes automatically, while Linux clients need the --accept-routes flag. [2]
- Create a Tailscale account. Tailscale lists its Personal plan as free for up to 6 users with unlimited user devices. [3]
- In the router admin panel, open Applications, then Tailscale, enable it and apply. [1]
- Open the Device Bind Link, sign in to Tailscale and connect; the router appears in the admin console with a Tailscale IP. [1]
- Enable only the option your job needs, then approve the advertised route or exit node in the admin console. [1][2]
- Test the exact destination, such as one printer page or the public IP through the exit node, from an outside connection.
The conflicts and gotchas GL.iNet documents
GL.iNet labels the feature beta and says it may have bugs. Because Tailscale is WireGuard-based, it advises against running it together with the OpenVPN client, WireGuard client, GoodCloud site-to-site, ZeroTier or AstroWarp, citing routing conflicts. [1]
For exit nodes, GL.iNet warns that with a private-only DNS server you may lose internet connectivity when running an exit node, and suggests setting a public DNS server. If clients lose internet under a custom exit node, it says to check that the router's subnet routes are enabled in the admin console. Tailscale likewise suggests disabling key expiry on a subnet router so it does not need periodic reauthentication. [1][2]
Worked example: a fictional travel router using home as exit
Dee has a Flint 2 at home and a Beryl AX for travel; both models appear on GL.iNet's supported list. She wants every device on the travel LAN to browse from her home connection and to reach a home NAS. At home, she enables Run Exit Node and Advertise LAN Subnets on Flint 2 and approves both in the admin console. On the Beryl AX, she enables Tailscale and selects Flint 2 under Custom Exit Nodes. [1]
She removes the WireGuard provider configuration from the Beryl AX, because GL.iNet advises against running both. She logs into the hotel portal first, then turns on Tailscale and checks the public IP and the NAS page separately. Each check is recorded as pending until it succeeds; this example is planning, not a test.
Who should skip the router app
If you only need your own laptop or phone to reach home, installing Tailscale directly on those devices is simpler and keeps the router free for a commercial VPN client. Skip the router app on unsupported models such as Opal, and skip it if you rely on the router's built-in VPN client for other work. Read the subnet-router-or-exit-node guide to decide which role you need first.
This guide summarizes GL.iNet and Tailscale documentation. We have not run Tailscale on these specific routers.
Questions before you decide
Does my GL.iNet router support Tailscale?
GL.iNet documents Tailscale from firmware 4.2 on a listed set of models, including GL-MT3000 (Beryl AX), GL-AXT1800 (Slate AX), GL-BE3600 (Slate 7) and GL-MT6000 (Flint 2). It lists GL-SFT1200 (Opal) and several older models as unsupported, and notes some models lack the memory.
Can I run Tailscale and my VPN provider on the router together?
GL.iNet advises against running Tailscale alongside the OpenVPN client, WireGuard client and several other features because of routing conflicts. Pick one for the router, or run the other on individual devices.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- GL.iNet docs: Tailscale (firmware 4) Accessed 13 Oct 2026
- Tailscale docs: Subnet routers Accessed 13 Oct 2026
- Tailscale pricing Accessed 13 Oct 2026
- GL.iNet docs: Network mode (firmware 4) Accessed 13 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.