# Preserve return routing when disabling Tailscale subnet SNAT

> Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.

- Canonical URL: https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T00:43:23+00:00
- Modified: 2026-10-15T00:44:33+00:00
- Last reviewed by DSE: 2026-10-14
- Resource type: Guide
- DSE priority: Information
- Topics: Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.

## Potentially affected

Apply this to the documented Linux subnet-router option. Check the current Tailscale configuration, destination routing, and access policy before changing a working deployment.

## DSE recommendation

DSE recommends drawing both directions of one representative connection before disabling SNAT.

## Article

Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.

## Source facts

Tailscale subnet routers use source NAT by default, making traffic appear to come from the subnet router. Its troubleshooting guide documents disabling subnet-route masquerading on Linux. With masquerading disabled, the destination network needs return routing for the original source addresses. The change therefore affects more than the source address visible in a server log.

Source: [Tailscale — Disable subnet route masquerading](https://tailscale.com/docs/reference/troubleshooting/network-configuration/disable-subnet-route-masquerading).

## Applicability

Apply this to the documented Linux subnet-router option. Check the current Tailscale configuration, destination routing, and access policy before changing a working deployment.

## DSE recommendation

DSE recommends drawing both directions of one representative connection before disabling SNAT. Identify the destination’s gateway, the administrator responsible for that gateway, and the routes needed for the actual client population. Review firewall rules and monitoring that currently expect the router’s address. Test a narrow, approved destination first, and keep a reversible change plan. Record why original-source visibility is needed so the operational benefit can be compared with the additional routing responsibility.

## Verification

Capture the source observed at the destination and verify that replies return to the intended client. Test permitted and denied application access without widening unrelated permissions. Include a client from each relevant source range. Record the route changes, observed results, and rollback outcome if the pilot fails.

## Official reference

[Tailscale — Disable subnet route masquerading](https://tailscale.com/docs/reference/troubleshooting/network-configuration/disable-subnet-route-masquerading). Reviewed October 14, 2026.

## Primary reference

- Name: Tailscale — Disable subnet route masquerading
- Authority: tailscale.com
- URL: https://tailscale.com/docs/reference/troubleshooting/network-configuration/disable-subnet-route-masquerading
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Preserve return routing when disabling Tailscale subnet SNAT,” DSE Security, https://update.dsesecurity.com/updates/tailscale-subnet-router-snat-return-route/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.