---
title: "Tailscale and another VPN on Mac: routing conflicts · Kilobat Guides"
url: "https://kilobat.app/guides/tailscale-vpn-routing-conflicts"
description: "Tailscale and a second VPN can block or overlap each other on a Mac. Check the routes and address ranges, then use one tunnel or a split tunnel."
---

VPN, proxy and filters

# Tailscale and another VPN conflict on a Mac

Tailscale gives each device an address in 100.64.0.0/10. Another VPN can block Tailscale traffic or use the same addresses.

Applies to: Current Tailscale for macOS on macOS 13 Ventura and later. The route commands work on all current macOS versions. · Checked: 29 October 2026

## Symptoms

- Tailscale devices stop answering when the other VPN connects.
- The other VPN stops working when Tailscale connects.
- Some 100.x.y.z addresses go to the wrong network.
- An exit node stops working when a second VPN is on.

## Likely causes

- **Strict VPN firewall rules.** Tailscale says that most VPNs block traffic that does not go through them. This can drop Tailscale traffic.
- **An address overlap.** A VPN that also uses the CGNAT range, 100.64.0.0 to 100.127.255.255, conflicts with Tailscale addresses.
- **Exit nodes.** Tailscale says that exit nodes support only one VPN at a time.
- **Overlapping subnet routes.** Two tunnels can claim the same local network range. The Mac sends the traffic to one of them only.

## How to check

1. Show the state of your Tailscale connections. With the App Store version, use the full path to the CLI.

   ```
   tailscale status
   ```
2. Test one device over Tailscale only. Replace the name with your device name.

   ```
   tailscale ping my-server
   ```
3. Show which interface carries traffic to a Tailscale address.

   ```
   route -n get 100.101.102.103
   ```
4. Show all routes. Look for two `utun` interfaces with the same ranges.

   ```
   netstat -rn
   ```
5. Get a report on the network under the tunnel.

   ```
   tailscale netcheck
   ```

## How to fix it

1. Disconnect the other VPN. Make sure that Tailscale works alone.
2. Ask the other VPN provider if it can exclude 100.64.0.0/10 and fd7a:115c:a1e0::/48 from its tunnel.
3. Add your Tailscale subnet routes to that exclusion list too.
4. Do not use a Tailscale exit node while another VPN is on.
5. If the address ranges overlap, ask your network admin to change one range.
6. If nothing helps, use one VPN at a time.

## With Kilobat

1. Kilobat's connection check names the interface for each path, such as Wi-Fi or a VPN. It compares the direct path with the tunnel.

   ```
   kilobat why my-server.example.ts.net
   ```
2. List the VPN interfaces and their counters.

   ```
   kilobat interfaces --json
   ```
3. If a hosted service must reach a Tailscale address, add `--context provider`. Kilobat then says that the address is private.

   ```
   kilobat why http://100.101.102.103:8080 --context provider
   ```

## Questions

**Where is the Tailscale CLI on a Mac?**

The App Store version includes it at /Applications/Tailscale.app/Contents/MacOS/Tailscale. The standalone version can install `tailscale` in /usr/local/bin.

**Why does Tailscale use 100.x.y.z addresses?**

Tailscale uses the CGNAT range 100.64.0.0/10 for device addresses. Other VPNs can use the same range.

## Sources

- [Tailscale: Can I use Tailscale alongside other VPNs?](https://tailscale.com/kb/1105/other-vpns)
- [Tailscale: CLI](https://tailscale.com/kb/1080/cli)
- [Tailscale: Interoperability with other software](https://tailscale.com/docs/reference/interoperability)
- route(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet): A VPN sends traffic through a tunnel.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts): Firewalls, VPNs and content filters on macOS use network extensions.
- [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names): macOS can send queries for one domain to one DNS server and other queries to another.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect): When the internet works but one address fails, Kilobat checks each layer in turn.