Tailscale MagicRoute (beta): how clients now choose between subnet routers and exit nodes
Tailscale's new route-selection option picks the nearest healthy connector for each client and keeps it stable. It is aimed at paid plans, but the idea matters to anyone with more than one subnet router.
By Andrew Ingleton · Published
On 19 October 2026 Tailscale announced MagicRoute, a beta way of choosing between several machines that advertise the same routes. Tailscale calls those machines "connectors": subnet routers, app connectors, exit nodes and Tailscale Service hosts. If you run one subnet router at home, nothing changes for you; if you have redundancy, it does.
The problem it replaces
The older approach, regional routing, grouped connectors by their home DERP relay region. According to the authors, that was the wrong criterion: latencies to several regions can be almost identical, so tiny jitter made connectors flap between regions, breaking existing sessions, and clients with the same DERP home could cascade into switching together.
How MagicRoute works
- Each client ranks every connector from its own point of view and connects to its top choice for each route or app.
- If several connectors tie, clients are spread fairly between them.
- The only signal today is coarse location. Tailscale says it estimates the client's location and keeps only the precision needed to match the nearest connector. Approximate distance is used because, unlike latency, it does not change unless the client moves.
- Clients stay on a healthy preferred connector, and if it goes offline they work down the ranked list until they find a healthy one.
- Because it does not depend on DERP regions, it works with custom DERP servers, which regional routing did not support.
Availability and limits
MagicRoute is in beta for Premium and Enterprise plans only. It is configured under Settings, General, Route Selection in the admin console, alongside active-passive failover, regional routing, and regional routing with in-region failover (the last of which needs support to enable). All client versions support it for subnet routers, app connectors and Service hosts; exit-node suggestions need client 1.86.0 or later.
- It is a single tailnet-wide setting: individual connectors cannot opt out.
- Location is the only scoring signal for now. Tailscale says it is exploring reachability checks and further signals, but does not describe them as available.
- The post does not discuss threat models, access control effects or how long location estimates are kept, so if that matters to you, ask Tailscale before enabling it.
Does a home lab need it?
Probably not yet. On the free Personal plan you cannot switch it on, and a typical home lab has a single subnet router. It becomes relevant if you run a second router at a relative's house or on a VPS for failover, where sessions that stay put are the whole point. For the security side of Tailscale, see our note on the Tailscale SSH findings.
