Tailscale subnet router breaks local lan access

Installing and Using OpenWrt
1

Setup overview

  • LAN1: OpenWRT router
    • Subnet: 192.168.1.0/24
    • Gateway: 192.168.1.1
  • Subnet router: OpenWRT + Tailscale client
    • LAN IP: 192.168.1.50
    • Installed via LuCI (System → Software)
  • LAN2: Remote site (OpenWRT + Tailscale)
    • Subnet: 192.168.10.0/24

Tailscale configuration (subnet router)

On 192.168.1.50:

tailscale up \
  --accept-dns=false \
  --accept-routes \
  --advertise-routes=192.168.1.0/24 \

What happens

When the subnet router comes online, Tailscale installs a routing table (table 52 on OpenWRT).

This causes all traffic for 192.168.1.0/24 to be routed through Tailscale instead of staying local.

Result:

  • LAN devices still work normally outbound
  • But LAN devices can no longer reach the subnet router via LAN IP

Example:

ssh user@192.168.1.50 :cross_mark: fails
ssh user@100.x.y.z :check_mark: works (Tailscale IP)

Problem

Tailscale route injection overrides local LAN routing.

Even though the device is physically on the same LAN, traffic to it gets pulled into the Tailscale routing table.

Fix

Force local LAN traffic to use the main routing table.

LuCI:

Network → Routing → IPv4 Rules

Or in /etc/config/network:

config rule
    option priority ‘50’
    option dest ‘192.168.1.0/24’
    option lookup ‘main’

Effect

This forces traffic for 192.168.1.0/24 to stay in the main routing table instead of being affected by Tailscale’s table 52.

Result:

  • LAN connectivity is restored
  • Subnet router is reachable via 192.168.1.50
  • Tailscale routing still works for remote access

Extra (site-to-site routing)

To complete full routing between sites:

On LAN1 router (192.168.1.1):

192.168.10.0/24 via 192.168.1.50

On LAN2 router (192.168.10.1):

192.168.1.0/24 via its local Tailscale/OpenWRT router

Result

  • Tailscale handles inter-site routing
  • LAN routing stays intact locally
  • Devices can reach subnet routers via LAN IP and Tailscale IP

(This fix might seem obvious in hindsight, but it took months to figure out.)

2

In the old days we copied all local routes over to the option tables nowadays no longer needed as we have suppress_prefixlength

For using local routes in your new routing table, which usually is a good idea, add suppress_prefixlength with lower priority so that the local routes of the main table will be used:

/etc/config/network:
config rule 'policy_localroute'
option lookup 'main'
option suppress_prefixlength '1' # See note
option priority '50' # lower priority then other rules so that it is hit first

IPv6
For IPv6 you do the same on LuCi > Network > routing > IPv6 Rules
Using source addresses is much more difficult as your lan clients will often use temporary IPv6 addresses so use ULA or LL addresses

I do not use Tailscale but Netbird that adds suppress_prefixlength and I am surprised that Tailscale does not do that