Tailscale and a VPN on the same Mac, without the fight

Why they clash

Tailscale is a VPN too. Most VPN apps set strict firewall rules so that all traffic goes through them, which drops Tailscale's, and both want to manage the Mac's routes and DNS. Tailscale's own documentation says that in most cases you can't use Tailscale alongside other VPNs without a workaround.

The workarounds below avoid running two full VPNs at once.

Let Tailscale be the VPN

If you only need a VPN to choose where your internet traffic comes out, use a Tailscale exit node: a machine of yours somewhere else, or the Mullvad exit nodes Tailscale offers as an add-on. There is only one VPN on the Mac, so nothing clashes. An exit node carries all of the Mac's internet traffic, though, not one app's.

Use a WireGuard config that leaves Tailscale alone

If your provider gives you WireGuard files, you can use one in the WireGuard app instead of the provider's own app, with Tailscale's address ranges (100.64.0.0/10 and fd7a:115c:a1e0::/48) removed from AllowedIPs. It works, but it is fiddly: you have to work out the remaining ranges, and people who do it report that Tailscale's MagicDNS names stop resolving while both are on, so you reach your devices by IP address.

Use the VPN as a proxy, not a VPN

If you only need the VPN for one or two apps, don't run the VPN app at all. Use your provider's SOCKS5 proxy, or turn a WireGuard file into a local SOCKS5 proxy with wireproxy, which runs as an ordinary program and doesn't touch the Mac's routing. With no second VPN on the Mac, there is nothing for Tailscale to fight with. Point the apps that need it at the proxy, in their own proxy settings.

Some providers only offer SOCKS5 from inside their VPN tunnel. If yours does, wireproxy with their WireGuard file is the way in.

The proxy route, for any app

We built Reroute because a VPN app's split tunnelling wouldn't run next to Tailscale. Reroute sends the apps you choose through that SOCKS5 proxy, from your provider or from wireproxy, including apps with no proxy setting of their own. It isn't a VPN, so it doesn't compete with Tailscale for anything.

• Tailscale addresses (100.64.0.0/10 and .ts.net names), your local network and plain DNS lookups are never routed, so Tailscale keeps working exactly as before.
• If the proxy goes down, routed apps' connections fail instead of quietly going out over your normal connection.
• A routed app's UDP is refused by default (browsers fall back to TCP through the proxy), or you can let it go direct.

Questions people ask

More guides