Preserve return routing when disabling Tailscale subnet SNAT

Map the return path before exposing original tailnet source addresses to a subnet behind a Tailscale router.

Source facts

Tailscale subnet routers use source NAT by default, making traffic appear to come from the subnet router. Its troubleshooting guide documents disabling subnet-route masquerading on Linux. With masquerading disabled, the destination network needs return routing for the original source addresses. The change therefore affects more than the source address visible in a server log.

Source: Tailscale — Disable subnet route masquerading.

Applicability

Apply this to the documented Linux subnet-router option. Check the current Tailscale configuration, destination routing, and access policy before changing a working deployment.

DSE recommendation

DSE recommends drawing both directions of one representative connection before disabling SNAT. Identify the destination’s gateway, the administrator responsible for that gateway, and the routes needed for the actual client population. Review firewall rules and monitoring that currently expect the router’s address. Test a narrow, approved destination first, and keep a reversible change plan. Record why original-source visibility is needed so the operational benefit can be compared with the additional routing responsibility.

Verification

Capture the source observed at the destination and verify that replies return to the intended client. Test permitted and denied application access without widening unrelated permissions. Include a client from each relevant source range. Record the route changes, observed results, and rollback outcome if the pilot fails.

Official reference

Tailscale — Disable subnet route masquerading. Reviewed October 14, 2026.