VPN, proxy and filters

Tailscale and another VPN conflict on a Mac

Tailscale gives each device an address in 100.64.0.0/10. Another VPN can block Tailscale traffic or use the same addresses.

Applies to: Current Tailscale for macOS on macOS 13 Ventura and later. The route commands work on all current macOS versions.Checked: 29 October 2026

Symptoms

Tailscale devices stop answering when the other VPN connects.
The other VPN stops working when Tailscale connects.
Some 100.x.y.z addresses go to the wrong network.
An exit node stops working when a second VPN is on.

Likely causes

Strict VPN firewall rules. Tailscale says that most VPNs block traffic that does not go through them. This can drop Tailscale traffic.
An address overlap. A VPN that also uses the CGNAT range, 100.64.0.0 to 100.127.255.255, conflicts with Tailscale addresses.
Exit nodes. Tailscale says that exit nodes support only one VPN at a time.
Overlapping subnet routes. Two tunnels can claim the same local network range. The Mac sends the traffic to one of them only.

How to check

Show the state of your Tailscale connections. With the App Store version, use the full path to the CLI.
```
tailscale status
```
Test one device over Tailscale only. Replace the name with your device name.
```
tailscale ping my-server
```
Show which interface carries traffic to a Tailscale address.
```
route -n get 100.101.102.103
```
Show all routes. Look for two utun interfaces with the same ranges.
```
netstat -rn
```
Get a report on the network under the tunnel.
```
tailscale netcheck
```

How to fix it

Disconnect the other VPN. Make sure that Tailscale works alone.
Ask the other VPN provider if it can exclude 100.64.0.0/10 and fd7a:115c:a1e0::/48 from its tunnel.
Add your Tailscale subnet routes to that exclusion list too.
Do not use a Tailscale exit node while another VPN is on.
If the address ranges overlap, ask your network admin to change one range.
If nothing helps, use one VPN at a time.

With Kilobat

Kilobat's connection check names the interface for each path, such as Wi-Fi or a VPN. It compares the direct path with the tunnel.
```
kilobat why my-server.example.ts.net
```
List the VPN interfaces and their counters.
```
kilobat interfaces --json
```
If a hosted service must reach a Tailscale address, add --context provider. Kilobat then says that the address is private.
```
kilobat why http://100.101.102.103:8080 --context provider
```

Questions

Where is the Tailscale CLI on a Mac?

The App Store version includes it at /Applications/Tailscale.app/Contents/MacOS/Tailscale. The standalone version can install tailscale in /usr/local/bin.

Why does Tailscale use 100.x.y.z addresses?

Tailscale uses the CGNAT range 100.64.0.0/10 for device addresses. Other VPNs can use the same range.

Sources

Tailscale: Can I use Tailscale alongside other VPNs?
Tailscale: CLI
Tailscale: Interoperability with other software
route(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.