{"slug":"troubleshoot-cgnat-conflicts","title":"Troubleshoot CGNAT conflicts","tags":["tailscale","networking"],"agent_summary":"Last validated: Mar 16, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Troubleshoot CGNAT conflicts\r\n\r\nLast validated: Mar 16, 2026\r\n\r\nTailscale assigns each device in your tailnet a unique [100.x.y.z](https://tailscale.com/docs/concepts/tailscale-ip-addresses) IP address. This is called the carrier grade NAT (CGNAT) address space, reserved by [RFC6598](https://www.rfc-editor.org/rfc/rfc6598.html), _IANA-Reserved IPv4 Prefix for Shared Address Space_. CGNAT conflicts can arise, for example, if your internet service provider (ISP), or [other VPN](https://tailscale.com/docs/reference/faq/other-vpns), also uses the `100.64.0.0/10` subnet (from `100.64.0.0` to `100.127.255.255`).\r\n\r\nIf you are experiencing CGNAT conflicts, you can disable IPv4 in your tailnet. This will cause Tailscale to use IPv6 only. Be aware that disabling IPv4 will prevent you from accessing IPv4-only resources on your network. For example, IPv4-only exit nodes will not be accessible.\r\n\r\n## [Selectively disable IPv4](https://tailscale.com/docs/reference/troubleshooting/network-configuration/cgnat-conflicts\\#selectively-disable-ipv4)\r\n\r\nTo selectively disable IPv4, apply the `disable-ipv4` [node attribute](https://tailscale.com/docs/reference/syntax/policy-file#nodeattrs) to the targets that require it in your tailnet's access control policies:\r\n\r\n```json\r\n{\r\n  \"nodeAttrs\": [\\\r\n\t{\\\r\n\t  \"target\": [\"tag:lab-foo\"],\\\r\n\t  \"attr\":   [\"disable-ipv4\"],\\\r\n\t},\\\r\n  ]\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n## [Disable IPv4 tailnet-wide](https://tailscale.com/docs/reference/troubleshooting/network-configuration/cgnat-conflicts\\#disable-ipv4-tailnet-wide)\r\n\r\nTo disable IPv4 tailnet-wide, apply the `disable-ipv4` [node attribute](https://tailscale.com/docs/reference/syntax/policy-file#nodeattrs) to all targets in your tailnet's access control policies:\r\n\r\n```json\r\n{\r\n  \"nodeAttrs\": [\\\r\n\t{\\\r\n\t  \"target\": [\"*\"],\\\r\n\t  \"attr\":   [\"disable-ipv4\"],\\\r\n\t},\\\r\n  ]\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Troubleshoot CGNAT conflicts</h1>\n<p>Last validated: Mar 16, 2026</p>\n<p>Tailscale assigns each device in your tailnet a unique <a href=\"https://tailscale.com/docs/concepts/tailscale-ip-addresses\">100.x.y.z</a> IP address. This is called the carrier grade NAT (CGNAT) address space, reserved by <a href=\"https://www.rfc-editor.org/rfc/rfc6598.html\">RFC6598</a>, <em>IANA-Reserved IPv4 Prefix for Shared Address Space</em>. CGNAT conflicts can arise, for example, if your internet service provider (ISP), or <a href=\"https://tailscale.com/docs/reference/faq/other-vpns\">other VPN</a>, also uses the <code>100.64.0.0/10</code> subnet (from <code>100.64.0.0</code> to <code>100.127.255.255</code>).</p>\n<p>If you are experiencing CGNAT conflicts, you can disable IPv4 in your tailnet. This will cause Tailscale to use IPv6 only. Be aware that disabling IPv4 will prevent you from accessing IPv4-only resources on your network. For example, IPv4-only exit nodes will not be accessible.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/troubleshooting/network-configuration/cgnat-conflicts#selectively-disable-ipv4\">Selectively disable IPv4</a></h2>\n<p>To selectively disable IPv4, apply the <code>disable-ipv4</code> <a href=\"https://tailscale.com/docs/reference/syntax/policy-file#nodeattrs\">node attribute</a> to the targets that require it in your tailnet's access control policies:</p>\n<pre><code class=\"language-json\">{\r\n  \"nodeAttrs\": [\\\r\n\t{\\\r\n\t  \"target\": [\"tag:lab-foo\"],\\\r\n\t  \"attr\":   [\"disable-ipv4\"],\\\r\n\t},\\\r\n  ]\r\n}\n</code></pre>\n<p>You can use the <a href=\"https://tailscale.com/docs/features/visual-editor\">visual policy editor</a> to manage your tailnet policy file. Refer to the <a href=\"https://tailscale.com/docs/reference/visual-editor\">visual editor reference</a> for guidance on using the visual editor.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/troubleshooting/network-configuration/cgnat-conflicts#disable-ipv4-tailnet-wide\">Disable IPv4 tailnet-wide</a></h2>\n<p>To disable IPv4 tailnet-wide, apply the <code>disable-ipv4</code> <a href=\"https://tailscale.com/docs/reference/syntax/policy-file#nodeattrs\">node attribute</a> to all targets in your tailnet's access control policies:</p>\n<pre><code class=\"language-json\">{\r\n  \"nodeAttrs\": [\\\r\n\t{\\\r\n\t  \"target\": [\"*\"],\\\r\n\t  \"attr\":   [\"disable-ipv4\"],\\\r\n\t},\\\r\n  ]\r\n}\n</code></pre>\n<p>You can use the <a href=\"https://tailscale.com/docs/features/visual-editor\">visual policy editor</a> to manage your tailnet policy file. Refer to the <a href=\"https://tailscale.com/docs/reference/visual-editor\">visual editor reference</a> for guidance on using the visual editor.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}