@@ -14,6 +14,7 @@ imports = [
     ../roles/home.nix
     ../roles/server.nix
     ../roles/router.nix
+    ../roles/tailscale-subnet-router.nix
     ../settings/hardware/usb-serial-tty.nix
   ];
   age.secrets = {
@@ -60,12 +61,6 @@ RequiredForOnline = "routable";
         };
       };
     };
-  };
-
-  services.tailscale = {
-    extraSetFlags = [
-      "--advertise-routes 10.0.0.0/16"
-    ];
   };
 
   environment.systemPackages = with pkgs; [

@@ -88,13 +88,6 @@ #     };
   #   };
   # };
 
-  services.tailscale = {
-    extraSetFlags = [
-      "--advertise-exit-node"
-      "--advertise-routes=10.0.0.0/16,fd12:d04f:65d:42::/56"
-    ];
-  };
-
   environment.systemPackages = with pkgs; [
     file
     tree

@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  lan = builtins.head config.networking.nat.internalInterfaces;
+  withArg =
+    arg: list:
+    if list == [ ] || builtins.length list == 1 then
+      list
+    else
+      lib.concatMap (x: [
+        arg
+        x
+      ]) list;
+in
+{
+  networking.firewall.extraForwardRules = ''
+    iifname "tailscale0" oifname "${lan}" accept
+    iifname "${lan}" oifname "tailscale0" accept
+  '';
+
+  services.tailscale.extraSetFlags =
+    withArg "--advertise-routes"
+      config.systemd.network.networks."40-${lan}".address;
+}