{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/tailscale-subnet-router-snat-return-route/", "item": { "id": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/", "slug": "tailscale-subnet-router-snat-return-route", "url": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route.md", "json": "https://update.dsesecurity.com/api/v1/posts/tailscale-subnet-router-snat-return-route/" }, "title": "Preserve return routing when disabling Tailscale subnet SNAT", "summary": "Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T00:43:23+00:00", "modified_at": "2026-10-15T00:44:33+00:00", "reviewed_on": "2026-10-14", "reading_minutes": 2, "word_count": 236, "potentially_affected": "Apply this to the documented Linux subnet-router option. Check the current Tailscale configuration, destination routing, and access policy before changing a working deployment.", "dse_recommendation": "DSE recommends drawing both directions of one representative connection before disabling SNAT.", "primary_source": { "name": "Tailscale — Disable subnet route masquerading", "url": "https://tailscale.com/docs/reference/troubleshooting/network-configuration/disable-subnet-route-masquerading", "published_on": null, "authority": "tailscale.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.

\n

Source facts

\n

Tailscale subnet routers use source NAT by default, making traffic appear to come from the subnet router. Its troubleshooting guide documents disabling subnet-route masquerading on Linux. With masquerading disabled, the destination network needs return routing for the original source addresses. The change therefore affects more than the source address visible in a server log.

\n

Source: Tailscale — Disable subnet route masquerading.

\n

Applicability

\n

Apply this to the documented Linux subnet-router option. Check the current Tailscale configuration, destination routing, and access policy before changing a working deployment.

\n

DSE recommendation

\n

DSE recommends drawing both directions of one representative connection before disabling SNAT. Identify the destination’s gateway, the administrator responsible for that gateway, and the routes needed for the actual client population. Review firewall rules and monitoring that currently expect the router’s address. Test a narrow, approved destination first, and keep a reversible change plan. Record why original-source visibility is needed so the operational benefit can be compared with the additional routing responsibility.

\n

Verification

\n

Capture the source observed at the destination and verify that replies return to the intended client. Test permitted and denied application access without widening unrelated permissions. Include a client from each relevant source range. Record the route changes, observed results, and rollback outcome if the pilot fails.

\n

Official reference

\n

Tailscale — Disable subnet route masquerading. Reviewed October 14, 2026.

", "content_text": "Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.\nSource facts\nTailscale subnet routers use source NAT by default, making traffic appear to come from the subnet router. Its troubleshooting guide documents disabling subnet-route masquerading on Linux. With masquerading disabled, the destination network needs return routing for the original source addresses. The change therefore affects more than the source address visible in a server log.\nSource: Tailscale — Disable subnet route masquerading.\nApplicability\nApply this to the documented Linux subnet-router option. Check the current Tailscale configuration, destination routing, and access policy before changing a working deployment.\nDSE recommendation\nDSE recommends drawing both directions of one representative connection before disabling SNAT. Identify the destination’s gateway, the administrator responsible for that gateway, and the routes needed for the actual client population. Review firewall rules and monitoring that currently expect the router’s address. Test a narrow, approved destination first, and keep a reversible change plan. Record why original-source visibility is needed so the operational benefit can be compared with the additional routing responsibility.\nVerification\nCapture the source observed at the destination and verify that replies return to the intended client. Test permitted and denied application access without widening unrelated permissions. Include a client from each relevant source range. Record the route changes, observed results, and rollback outcome if the pilot fails.\nOfficial reference\nTailscale — Disable subnet route masquerading. Reviewed October 14, 2026.", "content_markdown": "Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.\n\n## Source facts\n\nTailscale subnet routers use source NAT by default, making traffic appear to come from the subnet router. Its troubleshooting guide documents disabling subnet-route masquerading on Linux. With masquerading disabled, the destination network needs return routing for the original source addresses. The change therefore affects more than the source address visible in a server log.\n\nSource: [Tailscale — Disable subnet route masquerading](https://tailscale.com/docs/reference/troubleshooting/network-configuration/disable-subnet-route-masquerading).\n\n## Applicability\n\nApply this to the documented Linux subnet-router option. Check the current Tailscale configuration, destination routing, and access policy before changing a working deployment.\n\n## DSE recommendation\n\nDSE recommends drawing both directions of one representative connection before disabling SNAT. Identify the destination’s gateway, the administrator responsible for that gateway, and the routes needed for the actual client population. Review firewall rules and monitoring that currently expect the router’s address. Test a narrow, approved destination first, and keep a reversible change plan. Record why original-source visibility is needed so the operational benefit can be compared with the additional routing responsibility.\n\n## Verification\n\nCapture the source observed at the destination and verify that replies return to the intended client. Test permitted and denied application access without widening unrelated permissions. Include a client from each relevant source range. Record the route changes, observed results, and rollback outcome if the pilot fails.\n\n## Official reference\n\n[Tailscale — Disable subnet route masquerading](https://tailscale.com/docs/reference/troubleshooting/network-configuration/disable-subnet-route-masquerading). Reviewed October 14, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/", "url": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-14" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Preserve return routing when disabling Tailscale subnet SNAT", "item": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/#article", "identifier": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/", "url": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/", "headline": "Preserve return routing when disabling Tailscale subnet SNAT", "description": "Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.", "abstract": "Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.", "articleBody": "Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.\nSource facts\nTailscale subnet routers use source NAT by default, making traffic appear to come from the subnet router. Its troubleshooting guide documents disabling subnet-route masquerading on Linux. With masquerading disabled, the destination network needs return routing for the original source addresses. The change therefore affects more than the source address visible in a server log.\nSource: Tailscale — Disable subnet route masquerading.\nApplicability\nApply this to the documented Linux subnet-router option. Check the current Tailscale configuration, destination routing, and access policy before changing a working deployment.\nDSE recommendation\nDSE recommends drawing both directions of one representative connection before disabling SNAT. Identify the destination’s gateway, the administrator responsible for that gateway, and the routes needed for the actual client population. Review firewall rules and monitoring that currently expect the router’s address. Test a narrow, approved destination first, and keep a reversible change plan. Record why original-source visibility is needed so the operational benefit can be compared with the additional routing responsibility.\nVerification\nCapture the source observed at the destination and verify that replies return to the intended client. Test permitted and denied application access without widening unrelated permissions. Include a client from each relevant source range. Record the route changes, observed results, and rollback outcome if the pilot fails.\nOfficial reference\nTailscale — Disable subnet route masquerading. Reviewed October 14, 2026.", "datePublished": "2026-10-15T00:43:23+00:00", "dateModified": "2026-10-15T00:44:33+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Preserve return routing when disabling Tailscale subnet SNAT" }, "articleSection": [ "Networks & Infrastructure" ], "keywords": [ "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 236, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Tailscale — Disable subnet route masquerading", "url": "https://tailscale.com/docs/reference/troubleshooting/network-configuration/disable-subnet-route-masquerading" } } ] } }