#7472·tailscale

IP conflict with Alibaba Cloud CGNAT

Author: d960124Created Mar 6, 2023Updated Sep 30, 2026
LabelsL2 FewP3 Can't get startedT5 Usabilitybug

What is the issue?

Alibaba Cloud cannot update the software after installing the client

By default, Tailscale uses CGNAT (100.64.0.0/10) network segment as the internal address allocation network segment. At present, Tailscale only allows its own interface to use this network segment. Unfortunately, Alibaba Cloud's DNS, Apt source, etc. also use this network segment This will lead to the unavailability of DNS and Apt after Alibaba Cloud server installs the client. At present, the solution can only modify the source code, delete these two DROP rules and recompile them

code: args = [ ]string {"!","-i",r.tunname,"-s", tsaddr.CGNATRange().String(),"-j","DROP"} if err := r.ipt4.Append("filter","ts-input",args...);err !=nil { return fmt.Errorf("adding #{args} in v4/filter/ts-input: #{err}") }

阿里云安装客户端后无法更新软件 Tailscale 默认使用 CGNAT(100.64.0.0/10) 网段作为内部地址分配网段, 目前 Tailscale 仅允许自己的接口使用此网段, 不巧的是阿里云的 DNS、Apt 源等也采用此网段. 这会导致阿里云服务器安装客户端后 DNS、Apt 等不可用, 解决方案目前只能修改源码删除掉这两个 DROP 规则并重新编译.

Steps to reproduce

No response

Are there any recent changes that introduced the issue?

No response

OS

Linux

OS version

No response

Tailscale version

No response

Other software

No response

Bug report

No response