{"slug":"disable-subnet-route-masquerading","title":"Disable subnet route masquerading","tags":["tailscale","networking","routing"],"agent_summary":"Last validated: Mar 25, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Disable subnet route masquerading\r\n\r\nLast validated: Mar 25, 2026\r\n\r\nSource Network Address Translation (SNAT) affects how source IP addresses appear to devices in different parts of your network. By default, Tailscale performs SNAT on traffic passing through [subnet routers](https://tailscale.com/docs/features/subnet-routers), but this behavior can be modified when necessary.\r\n\r\nYou can disable subnet route masquerading with the following command (Linux only):\r\n\r\n```shell\r\ntailscale up --snat-subnet-routes=false\r\n```\r\n\r\nSNAT enables transparent communication to the rest of the network by re-writing the source IP address to that of the subnet router. If you disable subnet route masquerading, NAT traffic to local routes that are advertised with `--advertise-routes` will need to have routing manually configured.\r\n\r\nFor more information, refer to [Disable SNAT](https://tailscale.com/docs/features/subnet-routers#disable-snat).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Disable subnet route masquerading</h1>\n<p>Last validated: Mar 25, 2026</p>\n<p>Source Network Address Translation (SNAT) affects how source IP addresses appear to devices in different parts of your network. By default, Tailscale performs SNAT on traffic passing through <a href=\"https://tailscale.com/docs/features/subnet-routers\">subnet routers</a>, but this behavior can be modified when necessary.</p>\n<p>You can disable subnet route masquerading with the following command (Linux only):</p>\n<pre><code class=\"language-shell\">tailscale up --snat-subnet-routes=false\n</code></pre>\n<p>SNAT enables transparent communication to the rest of the network by re-writing the source IP address to that of the subnet router. If you disable subnet route masquerading, NAT traffic to local routes that are advertised with <code>--advertise-routes</code> will need to have routing manually configured.</p>\n<p>For more information, refer to <a href=\"https://tailscale.com/docs/features/subnet-routers#disable-snat\">Disable SNAT</a>.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}