Installing a VPN on your home PC and your office PC connects exactly two machines. The printer, the server and the old NAS cannot install anything — a subnet router is what brings them into reach.
This is the page that explains the one idea the whole setup stands on. A mesh VPN joins devices. An office, though, is a network — full of things that will never run a VPN app: network printers, CCTV DVRs, attendance machines, NAS boxes. Subnet routing is the bridge: one device that can run the app volunteers to carry traffic for the entire office address range, and the admin approves that promise. Understand this page and every other page in this series becomes simple.
When the office gateway signs in, it can make two very different offers. The small offer: reach me — remote users can connect to this one machine. The big offer: reach everything behind me — remote users can connect to the whole office subnet through this machine. The second offer is subnet routing, and it is the one you need for printers, servers and shared folders on devices without the app.
In the gateway's settings this appears as advertising a route such as 192.168.1.0/24 — the /24 simply means all addresses from 192.168.1.1 to 192.168.1.254, the usual size of a small office LAN.
Good mesh VPNs do not accept a route just because a device offers it. The route appears in the admin console as pending until the admin approves it. That pause is a security feature: it means a random laptop that joins the network cannot silently announce itself as the door to a whole office. When you set this up, the flow is always: gateway advertises → admin console shows the route → admin approves → remote users can reach the subnet.
Here is the failure that confuses everyone. Most home routers also use 192.168.1.0/24. If your home LAN and the office LAN have the same range, your home PC cannot tell whether 192.168.1.10 means the printer in your house or the server in the office — and it will usually pick the local one. Symptoms: the tunnel shows connected, some office devices answer, others mysteriously do not.
The clean fixes, in order: change the home router's LAN to a less common range (for example 192.168.50.0/24), or, in a bigger office, renumber the office once with IT help. Do not fight this with repeated reinstalls — it is an address conflict, not a software fault.
A single gateway PC is fine for a small office, but know its limits honestly: it is one point of failure, and all remote traffic passes through its CPU and its LAN cable. If several staff work from home daily, or the gateway PC is also someone's busy desktop, step up: put the gateway role on the server or on a router that supports it, and keep a second device ready as a backup gateway. Some tools let two gateways advertise the same route so one covers the other during restarts.
Two features get confused constantly. A subnet router lets remote users reach into the office LAN. An exit node does the opposite: it sends a device's internet browsing out through the office connection. For normal work-from-home you want the first and not the second. Turning on exit-node routing by accident makes home browsing crawl through the office line and lands the office's public IP on everything the staff member does at home — neither side wants that.
Watch the video to see a subnet route being advertised and approved live.
▶️ Watch Full VideoOnly if the printer itself could join the VPN, which normal network printers cannot. Without a subnet router you can reach just the computers that run the VPN app. The subnet router is what makes app-less devices — printers, DVRs, NAS boxes, attendance machines — reachable from home.
The most common cause is an address clash: your home router and the office use the same range, usually 192.168.1.0/24, so your PC sends some requests to local devices instead of through the tunnel. Change the home router's LAN range to something uncommon like 192.168.50.0/24 and the full office becomes reachable.
No. Routing office traffic for a handful of remote users is light work. What it needs is to be always on, wired to the LAN if possible, and not someone's gaming or editing machine. An old office PC or the existing server usually serves perfectly.