Subnet routes

Reach a whole network, like an office LAN or a cloud VPC, through one machine, without installing the app on every device in it.

A subnet router is a machine that offers a network it's on (for example 192.168.1.0/24) to the rest of your workspace. Once an admin approves the route, every device can reach the machines in that network, such as printers, NAS boxes or databases in a VPC, as if it were there.

Set one up

Advertise the route on the machine that's on that network:
bash
```
underpass set --advertise-routes=192.168.1.0/24
```
Separate several routes with commas: --advertise-routes=192.168.1.0/24,10.20.0.0/16.
Approve it. In the dashboard, open Routes and approve the route. Only routes that are both advertised and approved are used.

Other devices use approved routes automatically.

Stop advertising

bash

underpass set --advertise-routes=

Rules for routes

IPv4 only, written as the network address (192.168.1.0/24, not 192.168.1.10/24)
Up to 64 routes per machine
Not inside 100.64.0.0/10 (your network's own addresses), and not loopback, link-local or multicast
0.0.0.0/0 means an exit node, not a subnet route

When two machines offer the same network

Each device uses the first online machine offering that route. A device never routes a network it's already on itself, so devices in the office keep using the office network directly.

Turn off using routes on a device

bash

underpass set --accept-routes=false

The device then ignores every subnet route in the workspace. Set it back to true to use them again.

Access

To allow or limit access to a routed network, name it in an access rule by its CIDR, for example 192.168.1.0/24.