Using a Tailscale exit node? Keep access to the local LAN

The printer worked before the exit node went on, and now the laptop cannot see it. Selecting an exit node changes the default route, so the client stops sending local-subnet traffic out of the physical interface. That is the intended behaviour, not a failure of discovery. One documented setting restores the nearby network, and the work is understanding exactly which network it restores.

Why the printer vanishes when the exit node comes on

An exit node advertises itself as the route for internet traffic. Your client points its default route at the node, and the node forwards the packets onward, so everything that used to leave through the cafe Wi-Fi now leaves through the far end. Local destinations are not exempted by default. A device on the same Wi-Fi therefore becomes unreachable even though the laptop is still associated with that network.

The packets are routed into the tunnel and out the far side, where that LAN does not exist. Discovery protocols fail first because they depend on broadcast or multicast that will not cross the exit path. A saved printer queue then fails in a way that looks like a broken driver.

The option restores the LAN beside the laptop

The local-network option is about the network beside the client, not the network behind the exit node. If the laptop is on cafe Wi-Fi and the exit node is at home, the option restores access to cafe-side devices. It does not open the home LAN, and it does not create a route to the office. The exit-node documentation names --exit-node-allow-lan-access as the switch; pass it through tailscale set or tailscale up, whichever your client setup uses.

Enable it when the nearby network holds a resource you actually need. On a guest network, ask whether anything local is worth reaching at all.

The option does not make nearby devices trustworthy, and it does not override their own access controls. A printer that accepts jobs from the whole cafe is still a printer that accepts jobs from the whole cafe. Treat the setting as a routing convenience rather than a security boundary.

Reaching a remote office is a different mechanism

Reaching a home NAS that does not run Tailscale needs a subnet router. That device advertises the private prefix into the tailnet, and an administrator has to approve the route before clients can use it. The exit node plays no part in that path.

A device that runs Tailscale itself already has a tailnet address. It does not need the LAN option, and enabling the option will not make it appear.

Keep the three mechanisms separate. An exit node changes where internet traffic goes, a subnet router extends reachability to a private prefix, and local network access restores the physical LAN the laptop is attached to. Mixing them produces a configuration that looks right and routes nothing. Write down which one you are changing before you change it.

Test the address before the discovery list

After enabling local access, test the device by address and port rather than through a discovery menu. An empty printer list is not a complete test, because discovery can fail for reasons unrelated to unicast reachability. Start with the address and the service you need.

tailscale status
ping -c 2 192.168.1.50
nc -vz 192.168.1.50 9100

Read the three outputs in order. tailscale status shows whether the client still has the exit node selected, the ping proves the address is reachable, and the port check proves the service is listening. If the address works and the saved hostname does not, the problem is name resolution. If neither works, check the selected route, the destination's service and its firewall before changing the client again.

Decide per network, then re-test after a change

Enable local access on networks where you trust the neighbours and need the resource. Leave it off on untrusted networks where the only goal is a public exit. The setting follows the network, so a laptop that moves between a home LAN and a cafe needs a deliberate answer for each.

Re-test the resource whenever the network or the chosen exit node changes. Public browsing and local reach are two separate checks, and a printer that answers tells you nothing about the path your browser took. Record which setting is on for which network, so a later change does not silently undo it. A line in the profile prevents a repeat of the same ticket.