Write the destination before changing routing
A remote-access request often hides two different jobs: reaching a printer at home and sending ordinary web traffic through a home connection. Put each destination in its own worksheet row. Record who owns it, which client needs access, and the smallest useful test. This guide is a planning procedure based on documentation, not a tested network configuration. Only change networks and devices you are authorized to administer.
Tailscale describes direct client installation as preferable where feasible. A subnet router extends access to devices that cannot run that client; an exit node handles outbound internet routing. These roles can coexist, but one does not automatically establish the other. [1][2]
Choose one role for the first test
For a computer that supports Tailscale, investigate installing the client directly before adding a gateway. For an appliance that cannot run it, record the private address or subnet that must be reachable through a subnet router. For public internet routing, identify the proposed exit node and the client that will select it. Keep unrelated destinations out of the initial test.
The subnet setup documentation separates advertising routes, approving them, access rules, and client use. The exit-node documentation likewise separates advertising, approval, permission, and client selection. Treat those as separate checks; a visible device in an administration console is insufficient evidence that your application works. [1][2]
Prepare a bounded change record
Write down the existing working connection, the proposed gateway, operating system, installed client version, and the exact vendor instructions for that platform. Record a local recovery contact or access path before making a remote change that could disconnect you. Use the worksheet for status and ownership, never passwords or reusable authentication material.
Ask the administrator to review the intended destination and access scope. Avoid widening access just because the first attempt fails. Check whether the target application itself is listening and whether its own login works. A routing failure, an application failure, and a rejected application login need different fixes.
Worked example: a fictional home printer
In this simulated example, Jo needs to reach an owned printer from a laptop while away. The printer cannot run Tailscale; the laptop can. Jo selects a subnet-router investigation and leaves the exit-node column unnecessary. The worksheet records printer access as pending until an authorized print test succeeds from the outside connection.
A second request appears: use a home connection for a permitted web-service test. Jo adds a separate exit-node row. Even if the printer test passes, that row remains pending. This prevents a single green status from hiding two distinct requirements. No latency, print success, or service compatibility in this example is measured.
Verify the result and the failure path
Test from the actual intended client connection, using the exact target application. Record the time, destination, expected result, and observed result. For exit-node routing, Tailscale documents checking the resulting public IP address; this is evidence about internet egress, not proof that every private-network service is reachable. Local-network access also has its own exit-node setting. [2]
Finally, document how to stop using the added route and recover the previous connection. Repeat a representative task after reconnecting the client. If any permission, route approval, or target behavior remains unresolved, keep the decision pending. This worksheet cannot establish employer permission, network security completeness, uptime, or a product's suitability for your particular hardware.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Tailscale: Subnet routers; validated January 12, 2026 Accessed 2026-09-14
- Tailscale: Exit nodes; validated December 15, 2025 Accessed 2026-09-14
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.