CGNAT interoperability

Tailscale assigns addresses in the CGNAT range (100.64.0.0/10). To protect this range, the Linux client installs a firewall rule that drops any traffic in it that is not valid Tailscale traffic.

That default assumes Tailscale is the only thing using the range. But 100.64.0.0/10 is the general carrier-grade NAT range, and some organizations already run their own infrastructure there, including:

• Existing VPNs or private networking systems.
• Kubernetes clusters (for example, API servers in CGNAT address space).
• Subnet-routed internal services.

The drop rule cannot tell legitimate internal traffic apart from spoofed Tailscale traffic, so it blocks both. As a result, devices cannot reach local CGNAT-addressed services while Tailscale is running. Disabling the drop rule lets those devices use Tailscale and reach internal CGNAT-addressed services at the same time.

Only disable the drop rule if you have non-Tailscale services in 100.64.0.0/10. If you do not, keep it enabled.

Least privilege model behavior change

Disabling the CGNAT drop rule removes a built-in protection against IP spoofing from local networks.

Without the drop rule, a device on the local network could send packets that appear to come from a Tailscale IP. This weakens Tailscale's default least-privilege model.

To mitigate this, make sure Reverse Path Filtering (RPF) is enabled:

• RPF verifies packets arrive on the correct interface.
• Prevent spoofed traffic from being accepted.
• Enabled by default on modern Linux distributions.

Verify RPF status

On many distributions, you can check the RPF status with:

sysctl net.ipv4.conf.all.rp_filter

• 0: disabled (not recommended)
• 1: strict
• 2: loose

Troubleshoot RPF warnings

You may receive warnings indicating:

• CGNAT drop rule is disabled.

  This means:

  • The system may accept spoofed CGNAT traffic.

• RPF is not enabled.

  This means:

  • You should enable RPF or apply firewall controls.

Disable the CGNAT drop rule

Modify your tailnet policy file to enable client-side netmap caching with disable-linux-cgnat-drop-rule node attribute.

This example targets all devices tagged internal-subnet-routers.

{
  "nodeAttrs": [
    {
      "target": ["tag:internal-subnet-routers"],
      "attr": ["disable-linux-cgnat-drop-rule"]
    }
  ]
}

Removing the attribute restores the drop rule automatically.

Verify the CGNAT drop rule is disabled

Use the iptables command with the -L flag (list):

iptables -L

Check the ts-input chain has a RETURN rule instead of a DROP rule for 100.64.0.0/10.

Limitations

• Linux only by design. Other platforms do not implement a CGNAT drop rule.
• No partial range control.
• Does not address via route restrictions for CGNAT rules.

Interaction with nodivert

Before disable-linux-cgnat-drop-rule being available, --netfilter-mode=nodivert was a recommended solution for letting devices to continue using Tailscale and reach internal CGNAT-addressed services simultaneously.

If both disable-linux-cgnat-drop-rule and nodivert are configured, nodivert takes precedence. You are expected to manage firewall behavior manually in this mode.