Tailscale IP range

Where 100.64.0.0/10 comes from

100.64.0.0/10 is the shared address space reserved by RFC 6598 for carrier-grade NAT: internet providers use it between their network and your router when they do not have enough public IPv4 addresses. It is never routed on the public internet, which makes it a convenient private range for overlay networks. Tailscale picks each device’s address from it, from 100.64.0.0 to 100.127.255.255.

The IPv6 prefix fd7a:115c:a1e0::/48 is a unique local address range (RFC 4193) that Tailscale chose for all tailnets.

Clashes with your provider

If your ISP also uses 100.64.0.0/10 for carrier-grade NAT, your router’s WAN address may be in the same range. Usually this works, because Tailscale only routes the specific /32 addresses of your devices. If a device on your tailnet happens to get the same address as a host in your ISP’s network, that one host becomes unreachable; you can restrict the range Tailscale assigns from in the admin console under IP pool.

Allowing it in a firewall

# iptables: accept traffic from the tailnet
iptables -A INPUT -s 100.64.0.0/10 -i tailscale0 -j ACCEPT
ip6tables -A INPUT -s fd7a:115c:a1e0::/48 -i tailscale0 -j ACCEPT

# ufw
ufw allow in on tailscale0

Matching on the tailscale0 interface as well as the range matters: the same 100.64.0.0/10 addresses can arrive on your normal network interface from your ISP.

Public IP addresses

Traffic between devices goes directly or through Tailscale’s DERP relays, which have public addresses that are not published as a list. For networks that do publish their public ranges see Cloudflare, AWS and the other providers on the IP ranges page.