{"slug":"4via6-subnet-routers","title":"4via6 subnet routers","tags":["tailscale","routing"],"agent_summary":"Last validated: Feb 2, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# 4via6 subnet routers\r\n\r\nLast validated: Feb 2, 2026\r\n\r\nIn a large network, you may have existing subnets with overlapping IPv4 addresses. If there are two entirely separate virtual private clouds (VPCs) using the identical set of IP addresses and each has their own subnet router, Tailscale considers those two subnet routers as an [overlapping subnet router pair](https://tailscale.com/docs/how-to/set-up-high-availability). For example, when a Tailscale node tries to connect to `10.0.0.5`, its traffic will direct to whichever `10.0.0.5` device happens to be behind the primary subnet router of the failover pair at that moment.\r\n\r\nThe 4via6 (\"4 via 6\") subnet router feature provides an unambiguous, unique IPv6 address for each overlapping subnet, so a Tailscale node's traffic is routed to the correct device.\r\n\r\nThis featureis available for [the Personal, Premium, and Enterprise plans](https://tailscale.com/pricing).\r\n\r\nThis feature is useful when:\r\n\r\n- A network contains subnets with overlapping IP or CIDR ranges\r\n- Cloud resources or SaaS apps are rolled out to a network that contains subnets with overlapping IP or CIDR ranges\r\n- A partner or contractor network contains subnets with IP or CIDR ranges that overlap those of an organization that would like to share access\r\n\r\n## [How it works](https://tailscale.com/docs/features/subnet-routers/4via6-subnets\\#how-it-works)\r\n\r\nWhen you use this feature, your subnet router advertises an IPv6 subnet (using a Tailscale-specific address) that maps to the desired IPv4 subnet. Devices connecting to the IPv6 subnet router will have the IPv6 packets rewritten by Tailscale for IPv4, so the IPv4 addresses do not need to be changed.\r\n\r\nThe Tailscale-specific IPv6 subnet address is of the form:\r\n\r\n`fd7a:115c:a1e0:b1a:0:XXXX:YYYY:YYYY`\r\n\r\nwhere:\r\n\r\n- `fd7a:115c:a1e0:b1a` is the 64-bit fixed prefix used for Tailscale 4via6-routed packets.\r\n- `0:XXXX` is the 32-bit translator identifier. The site ID is the location that the IPv6 packets should arrive at before being translated to IPv4. Only the lower 16 bits may be used to specify a site ID—allowed values are 0 to 65535 inclusive. You choose which site IDs to assign to your subnet routes. For example, you might want to use `1` for your first subnet route, so the translator identifier would be `0:1`. A site ID of `0` is valid, but note the resulting IPv6 address, while allowed, would have an empty string for the translator identifier: `fd7a:115c:a1e0:b1a::YYYY:YYYY`.\r\n- `YYYY:YYYY` is the IPv4 address represented as 16 bit hex numbers.\r\n\r\nFor example, this would be the IPv6 subnet route for a site with ID `7` and IPv4 subnet address range `10.1.1.0/24` (which is represented as `a01:100/120` in 16 bit hex):\r\n\r\n![fd7a:115c:a1e0:b1a:7:a01:100/120 where 'fd7a:115c:a1e0:b1a' is the 64-bit fixed prefix used for Tailscale 4via6-routed packets, '7' is the site ID, and 'a01:100/120' is the IPv4 range represented in 16 bit hex](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2F4via6-subnets.e0799db4.png&w=3840&q=75)\r\n\r\nTailscale uses the IPv6 subnet address to route your tailnet traffic to the appropriate IPv4 destination.\r\n\r\nThe [Tailscale CLI](https://tailscale.com/docs/reference/tailscale-cli) provides the `tailscale debug via` command to help you create the IPv6 subnet route.\r\n\r\nIn versions of Tailscale prior to 1.58, only 4via6 addresses with site IDs from\r\n0-255 (inclusive) could be advertised. This restriction only applies to\r\nadvertising a 4via6 subnet; versions of Tailscale prior to 1.58 will be able to\r\naccess 4via6 subnets with larger site IDs even if they cannot advertise those\r\nsubnets.\r\n\r\n## [Setting up overlapping subnet routers](https://tailscale.com/docs/features/subnet-routers/4via6-subnets\\#setting-up-overlapping-subnet-routers)\r\n\r\n### [Step 1: Generate the IPv6 subnet route](https://tailscale.com/docs/features/subnet-routers/4via6-subnets\\#step-1-generate-the-ipv6-subnet-route)\r\n\r\nGenerate the IPv6 subnet route for your IPv4 subnet by running the Tailscale CLI command `tailscale debug via` with arguments for the site ID and IPv4 route. This example generates the IPv6 subnet route for a subnet with site ID `7` and IPv4 route `10.1.1.0/24`.\r\n\r\n```shell\r\ntailscale debug via 7 10.1.1.0/24\r\n```\r\n\r\nThe resulting IPv6 subnet route is:\r\n\r\n`fd7a:115c:a1e0:b1a:0:7:a01:100/120`\r\n\r\n### [Step 2: Advertise the IPv6 subnet route](https://tailscale.com/docs/features/subnet-routers/4via6-subnets\\#step-2-advertise-the-ipv6-subnet-route)\r\n\r\nFollow the steps for [setting up a subnet router](https://tailscale.com/docs/features/subnet-routers#set-up-a-subnet-router). However, when you advertise the route, use the IPv6 route that you created in Step 1 above. For example:\r\n\r\n```shell\r\n# Update to use the values for your subnet\r\ntailscale set --advertise-routes=fd7a:115c:a1e0:b1a:0:7:a01:100/120\r\n```\r\n\r\nNow a device in your tailnet can connect to distinct overlapping subnets with the same IPv4 addresses.\r\n\r\nYou can advertise both IPv4 and IPv6 subnet routes in the same subnet router.\r\n\r\nNote that if you expose the same IPv6 routes (that is, the same IPv4 routes with the same site ID) from multiple subnet routers, you are using [high availability](https://tailscale.com/docs/how-to/set-up-high-availability).\r\n\r\n## [MagicDNS name for the IPv4 subnet devices](https://tailscale.com/docs/features/subnet-routers/4via6-subnets\\#magicdns-name-for-the-ipv4-subnet-devices)\r\n\r\nIf you have enabled [MagicDNS](https://tailscale.com/docs/features/magicdns), you can use an automatically-created MagicDNS name to access devices in the overlapped subnets that you advertised. This name is of the form:\r\n\r\n`Q-R-S-T-via-X`\r\n\r\nwhere:\r\n\r\n- `Q-R-S-T` is the IPv4 address of the device\r\n- `X` is the site ID of the subnet router used when you created the [Tailscale-specific IPv6 address](https://tailscale.com/docs/features/subnet-routers/4via6-subnets#4via6-address-format)\r\n\r\nFor example, if IP address `10.1.1.16` is in the subnet you advertised by using `10.1.1.0/24` with site ID of 7, you can access it from your tailnet with the name `10-1-1-16-via-7`.\r\n\r\n## [High availability with 4via6 subnet routers](https://tailscale.com/docs/features/subnet-routers/4via6-subnets\\#high-availability-with-4via6-subnet-routers)\r\n\r\n[High availability](https://tailscale.com/docs/how-to/set-up-high-availability) is supported for 4via6 subnet routers.\r\n\r\nLet's say your tailnet has two separate VPCs, both using `172.16.0.0/16` as the subnet route. The subnet ranges overlap, so to prevent conflicts you use the 4via6 subnet router feature to create two 4via6 subnets routers. For this example, use site ID 1 for the first VPC and site ID 2 for the second VPC. To add subnet failover for the first VPC, advertise the route from another node that is attached to the first VPC as a 4via6 subnet router with ID 1 and the same `172.16.0.0/16` route. Tailscale will treat the two subnet routers with ID 1 as a subnet failover pair and pick one of them to be active. Similarly, you could create a subnet failover for the second VPC, by advertising an additional 4via6 subnet router with ID 2 and the `172.16.0.0/16` route on a node that is attached to the second VPC.\r\n\r\n## [Access control rules](https://tailscale.com/docs/features/subnet-routers/4via6-subnets\\#access-control-rules)\r\n\r\nWhen writing [access control](https://tailscale.com/docs/features/access-control) rules targeting resources behind a 4via6 subnet router, use the IPv6 CIDR or address as the destination, not the IPv4 address.\r\n\r\nUse `tailscale debug via` to get the IPv6 CIDR.\r\n\r\n## [Limitations](https://tailscale.com/docs/features/subnet-routers/4via6-subnets\\#limitations)\r\n\r\n- A 4via6 subnet router requires Tailscale v1.24 or later. Other Tailscale clients that use the 4via6 subnet router to reach the remote devices can use older releases.\r\n- Currently, only the IPv6 subnet address is shown in the admin console, not the IPv4 address that it maps to.\r\n- A tailnet can have a maximum of 65,536 site IDs. For each site ID, you can have any number of IPv4 CIDRs mapped.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

4via6 subnet routers

\n

Last validated: Feb 2, 2026

\n

In a large network, you may have existing subnets with overlapping IPv4 addresses. If there are two entirely separate virtual private clouds (VPCs) using the identical set of IP addresses and each has their own subnet router, Tailscale considers those two subnet routers as an overlapping subnet router pair. For example, when a Tailscale node tries to connect to 10.0.0.5, its traffic will direct to whichever 10.0.0.5 device happens to be behind the primary subnet router of the failover pair at that moment.

\n

The 4via6 (\"4 via 6\") subnet router feature provides an unambiguous, unique IPv6 address for each overlapping subnet, so a Tailscale node's traffic is routed to the correct device.

\n

This featureis available for the Personal, Premium, and Enterprise plans.

\n

This feature is useful when:

\n\n

How it works

\n

When you use this feature, your subnet router advertises an IPv6 subnet (using a Tailscale-specific address) that maps to the desired IPv4 subnet. Devices connecting to the IPv6 subnet router will have the IPv6 packets rewritten by Tailscale for IPv4, so the IPv4 addresses do not need to be changed.

\n

The Tailscale-specific IPv6 subnet address is of the form:

\n

fd7a:115c:a1e0:b1a:0:XXXX:YYYY:YYYY

\n

where:

\n\n

For example, this would be the IPv6 subnet route for a site with ID 7 and IPv4 subnet address range 10.1.1.0/24 (which is represented as a01:100/120 in 16 bit hex):

\n

\"fd7a:115c:a1e0:b1a:7:a01:100/120

\n

Tailscale uses the IPv6 subnet address to route your tailnet traffic to the appropriate IPv4 destination.

\n

The Tailscale CLI provides the tailscale debug via command to help you create the IPv6 subnet route.

\n

In versions of Tailscale prior to 1.58, only 4via6 addresses with site IDs from\r\n0-255 (inclusive) could be advertised. This restriction only applies to\r\nadvertising a 4via6 subnet; versions of Tailscale prior to 1.58 will be able to\r\naccess 4via6 subnets with larger site IDs even if they cannot advertise those\r\nsubnets.

\n

Setting up overlapping subnet routers

\n

Step 1: Generate the IPv6 subnet route

\n

Generate the IPv6 subnet route for your IPv4 subnet by running the Tailscale CLI command tailscale debug via with arguments for the site ID and IPv4 route. This example generates the IPv6 subnet route for a subnet with site ID 7 and IPv4 route 10.1.1.0/24.

\n
tailscale debug via 7 10.1.1.0/24\n
\n

The resulting IPv6 subnet route is:

\n

fd7a:115c:a1e0:b1a:0:7:a01:100/120

\n

Step 2: Advertise the IPv6 subnet route

\n

Follow the steps for setting up a subnet router. However, when you advertise the route, use the IPv6 route that you created in Step 1 above. For example:

\n
# Update to use the values for your subnet\r\ntailscale set --advertise-routes=fd7a:115c:a1e0:b1a:0:7:a01:100/120\n
\n

Now a device in your tailnet can connect to distinct overlapping subnets with the same IPv4 addresses.

\n

You can advertise both IPv4 and IPv6 subnet routes in the same subnet router.

\n

Note that if you expose the same IPv6 routes (that is, the same IPv4 routes with the same site ID) from multiple subnet routers, you are using high availability.

\n

MagicDNS name for the IPv4 subnet devices

\n

If you have enabled MagicDNS, you can use an automatically-created MagicDNS name to access devices in the overlapped subnets that you advertised. This name is of the form:

\n

Q-R-S-T-via-X

\n

where:

\n\n

For example, if IP address 10.1.1.16 is in the subnet you advertised by using 10.1.1.0/24 with site ID of 7, you can access it from your tailnet with the name 10-1-1-16-via-7.

\n

High availability with 4via6 subnet routers

\n

High availability is supported for 4via6 subnet routers.

\n

Let's say your tailnet has two separate VPCs, both using 172.16.0.0/16 as the subnet route. The subnet ranges overlap, so to prevent conflicts you use the 4via6 subnet router feature to create two 4via6 subnets routers. For this example, use site ID 1 for the first VPC and site ID 2 for the second VPC. To add subnet failover for the first VPC, advertise the route from another node that is attached to the first VPC as a 4via6 subnet router with ID 1 and the same 172.16.0.0/16 route. Tailscale will treat the two subnet routers with ID 1 as a subnet failover pair and pick one of them to be active. Similarly, you could create a subnet failover for the second VPC, by advertising an additional 4via6 subnet router with ID 2 and the 172.16.0.0/16 route on a node that is attached to the second VPC.

\n

Access control rules

\n

When writing access control rules targeting resources behind a 4via6 subnet router, use the IPv6 CIDR or address as the destination, not the IPv4 address.

\n

Use tailscale debug via to get the IPv6 CIDR.

\n

Limitations

\n\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}