{"slug":"reserved-ip-addresses","title":"Reserved IP addresses","tags":["tailscale"],"agent_summary":"Last validated: Jan 12, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Reserved IP addresses\r\n\r\nLast validated: Jan 12, 2026\r\n\r\nTailscale assigns each device in your [tailnet](https://tailscale.com/docs/concepts/tailnet) a unique [Tailscale IP address](https://tailscale.com/docs/concepts/tailscale-ip-addresses) from the Carrier-Grade NAT (CGNAT) range defined in [RFC 6598](https://www.rfc-editor.org/rfc/rfc6598.html). This range doesn't conflict with common private network ranges like `10.0.0.0/8` or `192.168.0.0/16`.\r\n\r\nTailscale reserves specific addresses within this range for internal services and device management. This topic helps you understand these reservations when configuring [IP pools](https://tailscale.com/docs/reference/ip-pool), writing [access control policies](https://tailscale.com/docs/reference/syntax/policy-file), or troubleshooting connectivity.\r\n\r\nThe following table lists the reserved IP addresses and ranges used by Tailscale:\r\n\r\n| Address or range | Purpose |\r\n| --- | --- |\r\n| `100.64.0.0/10` | The [CGNAT range](https://www.rfc-editor.org/rfc/rfc6598.html) Tailscale uses for [device IP addresses](https://tailscale.com/docs/concepts/tailscale-ip-addresses) (`100.64.0.0` through `100.127.255.255`). |\r\n| `100.100.0.0/24` | Tailscale internal use. Unavailable for [IP pools](https://tailscale.com/docs/reference/ip-pool). |\r\n| `100.100.100.0/24` | Tailscale internal use. Unavailable for [IP pools](https://tailscale.com/docs/reference/ip-pool). |\r\n| `100.100.100.100` | [Quad100](https://tailscale.com/docs/reference/quad100), a device-local service address. Provides a [DNS resolver](https://tailscale.com/docs/features/magicdns) on port `53` and a [device management interface](https://tailscale.com/docs/features/client/device-web-interface) on port `80`. |\r\n| `100.115.92.0/23` | Tailscale internal use. Unavailable for [IP pools](https://tailscale.com/docs/reference/ip-pool). |\r\n| `fd7a:115c:a1e0::/48` | The [IPv6 unique local address](https://en.wikipedia.org/wiki/Unique_local_address) prefix Tailscale uses for [device IPv6 addresses](https://tailscale.com/docs/concepts/ipv6). |\r\n| `fd7a:115c:a1e0::53` | IPv6 equivalent of [Quad100](https://tailscale.com/docs/reference/quad100). Provides the same DNS resolver and device management services. |\r\n| `100.101.102.103` | Reserved for the [`tshello`](https://tailscale.com/docs/install/with-cloud-init) example service. |\r\n\r\n## [What this means for you](https://tailscale.com/docs/reference/reserved-ip-addresses\\#what-this-means-for-you)\r\n\r\nYou can use Tailscale IP addresses directly in access control list (ACL) rules and grants. For example, specify a device by its `100.x.y.z` address in the `src` or `dst` fields. Keep in mind:\r\n\r\n- Reserved ranges aren't assignable. Tailscale never assigns addresses from the reserved ranges (`100.100.0.0/24`, `100.100.100.0/24`, or `100.115.92.0/23`) to devices, so you don't need to account for them in your policies.\r\n\r\n- Quad100 is device-local. Traffic to `100.100.100.100` stays on the local device and doesn't traverse your tailnet. You can't target Quad100 in access control policies.\r\n\r\n- IP pools can't overlap reserved ranges. When configuring [IP pools](https://tailscale.com/docs/reference/ip-pool), ensure your ranges don't overlap with reserved addresses.\r\n\r\n\r\nIf you integrate Tailscale with third-party services, verify that your network infrastructure doesn't use the CGNAT range (`100.64.0.0/10`) for other purposes. Some internet service providers (ISPs) use this range, which can cause [CGNAT conflicts](https://tailscale.com/docs/reference/troubleshooting/network-configuration/cgnat-conflicts).\r\n\r\n## [Troubleshooting](https://tailscale.com/docs/reference/reserved-ip-addresses\\#troubleshooting)\r\n\r\nIf you experience connectivity issues related to IP addresses, the following resources can help:\r\n\r\n- CGNAT conflicts: If your ISP or another virtual private network (VPN) uses the `100.64.0.0/10` range, you might experience routing conflicts. Refer to [CGNAT conflicts](https://tailscale.com/docs/reference/troubleshooting/network-configuration/cgnat-conflicts) for solutions, including how to disable IPv4 selectively or tailnet-wide.\r\n- Multiple devices with the same IP: Two devices can have the same Tailscale IP address if you restore one from a backup or clone a file system. Refer to [multiple devices have the same 100.x IP address](https://tailscale.com/docs/reference/troubleshooting/network-configuration/multiple-devices-same-100.x-ip-address) to resolve this.\r\n- DNS resolution issues: If [MagicDNS](https://tailscale.com/docs/features/magicdns) isn't resolving device names, verify that your device can reach the Quad100 DNS resolver at `100.100.100.100:53`. For Linux-specific issues, refer to [configuring Linux DNS](https://tailscale.com/docs/reference/linux-dns).\r\n- Device connectivity: For general connectivity troubleshooting, refer to [troubleshoot device connectivity](https://tailscale.com/docs/reference/troubleshooting/connectivity).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Reserved IP addresses</h1>\n<p>Last validated: Jan 12, 2026</p>\n<p>Tailscale assigns each device in your <a href=\"https://tailscale.com/docs/concepts/tailnet\">tailnet</a> a unique <a href=\"https://tailscale.com/docs/concepts/tailscale-ip-addresses\">Tailscale IP address</a> from the Carrier-Grade NAT (CGNAT) range defined in <a href=\"https://www.rfc-editor.org/rfc/rfc6598.html\">RFC 6598</a>. This range doesn't conflict with common private network ranges like <code>10.0.0.0/8</code> or <code>192.168.0.0/16</code>.</p>\n<p>Tailscale reserves specific addresses within this range for internal services and device management. This topic helps you understand these reservations when configuring <a href=\"https://tailscale.com/docs/reference/ip-pool\">IP pools</a>, writing <a href=\"https://tailscale.com/docs/reference/syntax/policy-file\">access control policies</a>, or troubleshooting connectivity.</p>\n<p>The following table lists the reserved IP addresses and ranges used by Tailscale:</p>\n<p>| Address or range | Purpose |\r\n| --- | --- |\r\n| <code>100.64.0.0/10</code> | The <a href=\"https://www.rfc-editor.org/rfc/rfc6598.html\">CGNAT range</a> Tailscale uses for <a href=\"https://tailscale.com/docs/concepts/tailscale-ip-addresses\">device IP addresses</a> (<code>100.64.0.0</code> through <code>100.127.255.255</code>). |\r\n| <code>100.100.0.0/24</code> | Tailscale internal use. Unavailable for <a href=\"https://tailscale.com/docs/reference/ip-pool\">IP pools</a>. |\r\n| <code>100.100.100.0/24</code> | Tailscale internal use. Unavailable for <a href=\"https://tailscale.com/docs/reference/ip-pool\">IP pools</a>. |\r\n| <code>100.100.100.100</code> | <a href=\"https://tailscale.com/docs/reference/quad100\">Quad100</a>, a device-local service address. Provides a <a href=\"https://tailscale.com/docs/features/magicdns\">DNS resolver</a> on port <code>53</code> and a <a href=\"https://tailscale.com/docs/features/client/device-web-interface\">device management interface</a> on port <code>80</code>. |\r\n| <code>100.115.92.0/23</code> | Tailscale internal use. Unavailable for <a href=\"https://tailscale.com/docs/reference/ip-pool\">IP pools</a>. |\r\n| <code>fd7a:115c:a1e0::/48</code> | The <a href=\"https://en.wikipedia.org/wiki/Unique_local_address\">IPv6 unique local address</a> prefix Tailscale uses for <a href=\"https://tailscale.com/docs/concepts/ipv6\">device IPv6 addresses</a>. |\r\n| <code>fd7a:115c:a1e0::53</code> | IPv6 equivalent of <a href=\"https://tailscale.com/docs/reference/quad100\">Quad100</a>. Provides the same DNS resolver and device management services. |\r\n| <code>100.101.102.103</code> | Reserved for the <a href=\"https://tailscale.com/docs/install/with-cloud-init\"><code>tshello</code></a> example service. |</p>\n<h2><a href=\"https://tailscale.com/docs/reference/reserved-ip-addresses#what-this-means-for-you\">What this means for you</a></h2>\n<p>You can use Tailscale IP addresses directly in access control list (ACL) rules and grants. For example, specify a device by its <code>100.x.y.z</code> address in the <code>src</code> or <code>dst</code> fields. Keep in mind:</p>\n<ul>\n<li>\n<p>Reserved ranges aren't assignable. Tailscale never assigns addresses from the reserved ranges (<code>100.100.0.0/24</code>, <code>100.100.100.0/24</code>, or <code>100.115.92.0/23</code>) to devices, so you don't need to account for them in your policies.</p>\n</li>\n<li>\n<p>Quad100 is device-local. Traffic to <code>100.100.100.100</code> stays on the local device and doesn't traverse your tailnet. You can't target Quad100 in access control policies.</p>\n</li>\n<li>\n<p>IP pools can't overlap reserved ranges. When configuring <a href=\"https://tailscale.com/docs/reference/ip-pool\">IP pools</a>, ensure your ranges don't overlap with reserved addresses.</p>\n</li>\n</ul>\n<p>If you integrate Tailscale with third-party services, verify that your network infrastructure doesn't use the CGNAT range (<code>100.64.0.0/10</code>) for other purposes. Some internet service providers (ISPs) use this range, which can cause <a href=\"https://tailscale.com/docs/reference/troubleshooting/network-configuration/cgnat-conflicts\">CGNAT conflicts</a>.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/reserved-ip-addresses#troubleshooting\">Troubleshooting</a></h2>\n<p>If you experience connectivity issues related to IP addresses, the following resources can help:</p>\n<ul>\n<li>CGNAT conflicts: If your ISP or another virtual private network (VPN) uses the <code>100.64.0.0/10</code> range, you might experience routing conflicts. Refer to <a href=\"https://tailscale.com/docs/reference/troubleshooting/network-configuration/cgnat-conflicts\">CGNAT conflicts</a> for solutions, including how to disable IPv4 selectively or tailnet-wide.</li>\n<li>Multiple devices with the same IP: Two devices can have the same Tailscale IP address if you restore one from a backup or clone a file system. Refer to <a href=\"https://tailscale.com/docs/reference/troubleshooting/network-configuration/multiple-devices-same-100.x-ip-address\">multiple devices have the same 100.x IP address</a> to resolve this.</li>\n<li>DNS resolution issues: If <a href=\"https://tailscale.com/docs/features/magicdns\">MagicDNS</a> isn't resolving device names, verify that your device can reach the Quad100 DNS resolver at <code>100.100.100.100:53</code>. For Linux-specific issues, refer to <a href=\"https://tailscale.com/docs/reference/linux-dns\">configuring Linux DNS</a>.</li>\n<li>Device connectivity: For general connectivity troubleshooting, refer to <a href=\"https://tailscale.com/docs/reference/troubleshooting/connectivity\">troubleshoot device connectivity</a>.</li>\n</ul>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}