Technical Anshu
Tutorials Blog
🏢 Branch to Branch

Connect Two Office Branches Without Static IP

The head office should see the branch stock, the branch should reach the head office Tally — but neither side has a static IP and leased VPN hardware is out of budget. One private network can hold both.

✍️ Technical Anshu🌐 Site to Site, Simplified⏱️ 7 minute read
🎥 Watch the full video — the Tailscale private network idea, from one office to one home user

Classic site-to-site VPN assumes two things small businesses rarely have — a static IP at both ends and someone who enjoys configuring tunnel hardware. Take away the static IPs and the classic design collapses. The Tailscale design in the video scales up gracefully instead: every branch PC joins one private network directly, and one always-on PC in each branch acts as a subnet router, carrying that branch's whole local network — Tally server, billing PCs, printers, DVR — into the same private space. No static IP, no tunnel hardware, no port opened at either site.

One Private Network, Two Branches
🏢 Head office LAN — via its subnet router PC192.168.1.0/24
🏪 Branch LAN — via its subnet router PC192.168.2.0/24
📒 Head office Tally server — reachable from branch192.168.1.10
🌍 Static IP purchasedNone ZERO OPEN PORTS
☝️ Notice the two different LAN ranges — that single detail decides whether branch-to-branch routing works cleanly or fights itself
1

First, Give Each Branch a Different LAN Range

This is the step that decides success, and it must happen before anything else.

  1. Two networks can only be joined if their address ranges do not overlap. If both branches use 192.168.1.x, a PC cannot tell whether 192.168.1.10 means the printer beside it or the server across town
  2. Renumber one branch — for example head office stays on 192.168.1.0/24 and the branch moves to 192.168.2.0/24 — by changing the LAN range in that branch's router
  3. Do the renumbering in a quiet hour. Devices pick up new addresses from DHCP automatically; note anything with a manually set address — servers, printers, DVRs — and update those by hand
  4. Write both ranges down. Every later step refers to them
2

Put Both Branches on One Tailscale Account

  1. Create the tailnet under the business owner's account — not an employee's personal login — and protect it with a strong password and two-factor authentication
  2. In each branch, choose the most reliable, always-on PC as the branch machine — ideally the one already acting as the Tally or file server — and install Tailscale on it
  3. Set both branch machines to never sleep. They are now infrastructure, and the other branch's access depends on them
  4. Add staff devices individually as needed. A company with staff at two sites belongs on a proper Tailscale business plan — say so in the budget honestly rather than stretching a personal free plan across a whole business
3

Advertise and Approve the Route at Each Branch

  1. On the head office PC, from an administrator terminal, run tailscale up --advertise-routes=192.168.1.0/24 using your real head office range
  2. On the branch PC, run the same command with the branch range — tailscale up --advertise-routes=192.168.2.0/24
  3. In the Tailscale admin console, open each machine and approve its advertised route. Both approvals are required before traffic flows either way
  4. Test from a branch PC — ping 192.168.1.10 against the head office server's real address. Replies mean the two offices are now one private network
4

Use It Like One Office — With Honest Expectations

  1. Branch staff can now open the head office Tally server, shared folders and printers by their ordinary LAN addresses, as if a very long cable joined the buildings
  2. Speed honesty — traffic between branches travels over both internet connections. Light work like Tally, files and printing is comfortable. Nobody should plan to stream heavy data or run big backups across it all day
  3. Tailscale prefers a direct connection between the subnet routers, which is the fast path. On difficult networks it falls back to relays, which work but are slower — if branch work feels sluggish, that is the first thing to investigate
  4. Each branch keeps working normally if the other branch or its internet goes down. Local work is never hostage to the link
5

Draw the Access Boundaries Deliberately ⭐

  1. Joining two LANs means, by default, devices can see a lot. Decide who should reach what — branch billing staff may need the head office Tally server, not every PC and camera in the building
  2. Use the access controls in the Tailscale admin console to limit groups of users to the servers they actually need, rather than leaving the whole joined network flat and open
  3. Keep the two subnet router PCs patched, password-protected and physically secure. Each one is a doorway between the branches
  4. And the standing rule from the whole series — neither branch needs, or should have, any forwarded port for this to work. If old forwarding rules exist from an earlier setup, delete them
⚠️ The trap in this project is success. When branch-to-branch access suddenly works, the temptation is to connect everything to everything. Resist it. A joined network with no internal boundaries means a problem in one branch — a virus, a careless shared folder — is a problem in both. Connect what the business needs, and write down what you connected.

🎥 Watch the Foundation Setup in the Full Video

The video builds the private network between an office and the outside world — this guide simply puts a second office on the same foundation.

▶️ Watch Full Video
❓ Frequently Asked Questions

Can I connect three or more branches the same way?

Yes. Each additional branch gets its own different LAN range, its own always-on subnet router PC, and its own approved route in the same admin console. The discipline matters more as you grow — keep a written list of every branch range and what it is allowed to reach.

What if both branches refuse to change their LAN range?

Then do not join the LANs. Overlapping ranges cannot be routed reliably, full stop. You still have a working option — skip subnet routing and run Tailscale directly on the specific machines that must talk, like the two Tally servers, and let them reach each other by their 100.x addresses. Machine-to-machine works even when network-to-network cannot.

Is this a real replacement for a leased line or MPLS?

For the workloads small branches actually run — accounts, billing, files, printing, support access — yes, for most it is, at a small fraction of the cost. It is not a replacement where a business has a contractual uptime guarantee requirement or moves very large data volumes between sites all day. Match the tool to the real need, not to the brochure.

This guide is based on the Technical Anshu no static IP remote access video • Stuck on any step? Ask in the video comments — help is available there 🙏