# Subnet routes

> Reach a whole network, like an office LAN or a cloud VPC, through one machine, without installing the app on every device in it.

A **subnet router** is a machine that offers a network it's on (for example `192.168.1.0/24`) to the rest of your workspace. Once an admin approves the route, every device can reach the machines in that network, such as printers, NAS boxes or databases in a VPC, as if it were there.

## Set one up

1. **Advertise the route** on the machine that's on that network:

   ```bash
   underpass set --advertise-routes=192.168.1.0/24
   ```

   Separate several routes with commas: `--advertise-routes=192.168.1.0/24,10.20.0.0/16`.
2. **Approve it.** In the dashboard, open **Routes** and approve the route. Only routes that are both advertised and approved are used.

Other devices use approved routes automatically.

## Stop advertising

```bash
underpass set --advertise-routes=
```

## Rules for routes

- IPv4 only, written as the network address (`192.168.1.0/24`, not `192.168.1.10/24`)
- Up to 64 routes per machine
- Not inside `100.64.0.0/10` (your network's own addresses), and not loopback, link-local or multicast
- `0.0.0.0/0` means an [exit node](/features/exit-nodes), not a subnet route

## When two machines offer the same network

Each device uses the first online machine offering that route. A device never routes a network it's already on itself, so devices in the office keep using the office network directly.

## Turn off using routes on a device

```bash
underpass set --accept-routes=false
```

The device then ignores every subnet route in the workspace. Set it back to `true` to use them again.

## Access

To allow or limit access to a routed network, name it in an [access rule](/features/access-controls) by its CIDR, for example `192.168.1.0/24`.