{"slug":"tailscale-ipv6-support","title":"Tailscale IPv6 support","tags":["tailscale"],"agent_summary":"Last validated: Jan 12, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Tailscale IPv6 support\r\n\r\nLast validated: Jan 12, 2026\r\n\r\nInternet Protocol version 6 (IPv6) is defined in [RFC8200](https://www.rfc-editor.org/rfc/rfc8200.html) and is the latest version of the Internet Protocol and the successor to IPv4. Tailscale supports both IPv4 and IPv6 and even facilitates connections between IPv4-only devices and IPv6-only devices using DERP servers.\r\n\r\n## [Private and public IPv6 addresses](https://tailscale.com/docs/concepts/ipv6\\#private-and-public-ipv6-addresses)\r\n\r\nSimilar to IPv4 addresses, there are two types of IPv6 addresses: private IPv6 addresses and public IPv6 addresses.\r\n\r\nPrivate IPv6 refers to the internal IPv6 addresses used within your Tailscale network (known as a [tailnet](https://tailscale.com/docs/concepts/tailnet)). These addresses are not exposed to the public internet. Tailscale assigns every device in your tailnet a private IPv6 address from the `fd7a:115c:a1e0::/48` [unique local prefix](https://en.wikipedia.org/wiki/Unique_local_address). This prefix is part of Tailscale's [reserved IP addresses](https://tailscale.com/docs/reference/reserved-ip-addresses). As a result, IPv6 connectivity always works within your tailnet, even if your internet service provider (ISP) doesn't support IPv6. In [userspace networking mode](https://tailscale.com/docs/concepts/userspace-networking), Tailscale emulates IPv6 support. This ensures IPv6 functionality even on devices that don't natively support it.\r\n\r\nPublic IPv6 refers to using IPv6 addresses provided by internet service providers (ISPs) for communication over the public internet. Tailscale can use public IPv6 addresses from a device's ISP when negotiating connections between devices, but only if both devices have public IPv6 addresses.\r\n\r\n[Exit nodes](https://tailscale.com/docs/features/exit-nodes) fully support IPv6. This means you can route traffic through an IPv6-supporting exit node even if your ISP doesn't provide IPv6 connectivity.\r\n\r\n## [IPv4 interoperability](https://tailscale.com/docs/concepts/ipv6\\#ipv4-interoperability)\r\n\r\nTailscale's [DERP servers](https://tailscale.com/docs/reference/derp-servers) can facilitate connections between IPv6-only and IPv4-only devices when direct connections aren't possible. For direct connections where one device lacks an IPv6 address, Tailscale defaults to using an IPv4 connection. The following table shows the IP address type two devices use given different conditions.\r\n\r\n| **Device A** | **Device B** | **Connection** |\r\n| --- | --- | --- |\r\n| IPv6-only | IPv4-only | [Relayed connection](https://tailscale.com/docs/reference/derp-servers) |\r\n| IPv4 and IPv6 | IPv4-only | IPv4 |\r\n| IPv4 and IPv6 | IPv6-only | IPv6 |\r\n| IPv4-only | IPv4-only | IPv4 |\r\n| IPv6-only | IPv6-only | IPv6 |\r\n\r\nIPv6 can improve [network address translation (NAT) traversal](https://tailscale.com/blog/how-nat-traversal-works) efficiency or eliminate the need for it entirely. However, Tailscale functions effectively over IPv4 when public IPv6 isn't available on both ends.\r\n\r\nFor more information about IPv4 and IPv6, refer to the [IPv4 vs. IPv6 FAQ](https://tailscale.com/docs/reference/faq/ipv6).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Tailscale IPv6 support</h1>\n<p>Last validated: Jan 12, 2026</p>\n<p>Internet Protocol version 6 (IPv6) is defined in <a href=\"https://www.rfc-editor.org/rfc/rfc8200.html\">RFC8200</a> and is the latest version of the Internet Protocol and the successor to IPv4. Tailscale supports both IPv4 and IPv6 and even facilitates connections between IPv4-only devices and IPv6-only devices using DERP servers.</p>\n<h2><a href=\"https://tailscale.com/docs/concepts/ipv6#private-and-public-ipv6-addresses\">Private and public IPv6 addresses</a></h2>\n<p>Similar to IPv4 addresses, there are two types of IPv6 addresses: private IPv6 addresses and public IPv6 addresses.</p>\n<p>Private IPv6 refers to the internal IPv6 addresses used within your Tailscale network (known as a <a href=\"https://tailscale.com/docs/concepts/tailnet\">tailnet</a>). These addresses are not exposed to the public internet. Tailscale assigns every device in your tailnet a private IPv6 address from the <code>fd7a:115c:a1e0::/48</code> <a href=\"https://en.wikipedia.org/wiki/Unique_local_address\">unique local prefix</a>. This prefix is part of Tailscale's <a href=\"https://tailscale.com/docs/reference/reserved-ip-addresses\">reserved IP addresses</a>. As a result, IPv6 connectivity always works within your tailnet, even if your internet service provider (ISP) doesn't support IPv6. In <a href=\"https://tailscale.com/docs/concepts/userspace-networking\">userspace networking mode</a>, Tailscale emulates IPv6 support. This ensures IPv6 functionality even on devices that don't natively support it.</p>\n<p>Public IPv6 refers to using IPv6 addresses provided by internet service providers (ISPs) for communication over the public internet. Tailscale can use public IPv6 addresses from a device's ISP when negotiating connections between devices, but only if both devices have public IPv6 addresses.</p>\n<p><a href=\"https://tailscale.com/docs/features/exit-nodes\">Exit nodes</a> fully support IPv6. This means you can route traffic through an IPv6-supporting exit node even if your ISP doesn't provide IPv6 connectivity.</p>\n<h2><a href=\"https://tailscale.com/docs/concepts/ipv6#ipv4-interoperability\">IPv4 interoperability</a></h2>\n<p>Tailscale's <a href=\"https://tailscale.com/docs/reference/derp-servers\">DERP servers</a> can facilitate connections between IPv6-only and IPv4-only devices when direct connections aren't possible. For direct connections where one device lacks an IPv6 address, Tailscale defaults to using an IPv4 connection. The following table shows the IP address type two devices use given different conditions.</p>\n<p>| <strong>Device A</strong> | <strong>Device B</strong> | <strong>Connection</strong> |\r\n| --- | --- | --- |\r\n| IPv6-only | IPv4-only | <a href=\"https://tailscale.com/docs/reference/derp-servers\">Relayed connection</a> |\r\n| IPv4 and IPv6 | IPv4-only | IPv4 |\r\n| IPv4 and IPv6 | IPv6-only | IPv6 |\r\n| IPv4-only | IPv4-only | IPv4 |\r\n| IPv6-only | IPv6-only | IPv6 |</p>\n<p>IPv6 can improve <a href=\"https://tailscale.com/blog/how-nat-traversal-works\">network address translation (NAT) traversal</a> efficiency or eliminate the need for it entirely. However, Tailscale functions effectively over IPv4 when public IPv6 isn't available on both ends.</p>\n<p>For more information about IPv4 and IPv6, refer to the <a href=\"https://tailscale.com/docs/reference/faq/ipv6\">IPv4 vs. IPv6 FAQ</a>.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}