Create a Tailscale Subnet Router for IPv6 — Excloud Docs Skip to content 🇮🇳 ₹ INR 🇮🇳 India INR<br>🇺🇸 United States USD<br>🇪🇺 Europe EUR<br>🇬🇧 United Kingdom GBP<br>🇯🇵 Japan JPY<br>🇸🇬 Singapore SGD<br>🇰🇷 South Korea KRW<br>🇨🇳 China CNY<br>Open console
Docs Quickstart Login and Registration Guide<br>CLI Installation<br>Guides Sandbox<br>Deploying Ubuntu<br>Deploying Ollama<br>Instance Connect<br>Drive Excloud from an AI Coding Agent<br>Add Team Members<br>Migrate a Server<br>Use DNS Names in Connection Strings<br>Create a Tailscale Subnet Router for IPv6<br>Policies<br>Pricing Compute<br>GPU<br>LLM<br>Object Storage<br>Email<br>Volume<br>Networking<br>Compute Instances<br>Volumes<br>Snapshots<br>Public IPv4<br>Subnets<br>Instance Types<br>SSH Keys<br>Serial Logs<br>Storage Object Storage (Buckets)<br>Quickstart<br>S3 Compatibility<br>Access Keys<br>Secrets Overview<br>Quickstart<br>DNS Overview<br>Quickstart<br>Zones<br>Records<br>Database Overview<br>Quickstart<br>Clusters<br>Nodes<br>Kubernetes Overview<br>Quickstart<br>Workload Identity<br>Streams Overview<br>Quickstart<br>Clusters<br>Topics<br>Users & ACLs<br>Terraform Overview<br>Quickstart<br>Networking Security Group<br>API Overview<br>Compute API<br>Database API<br>DNS API<br>IAM API<br>Limits Compute Bandwidth<br>Reference CLI Overview<br>Permissions Reference<br>Compute SLA
Why use IPv6 instead of IPv4?
A single Tailscale network, called a tailnet , can contain subnet routers from multiple cloud accounts. The problem with IPv4 is that independently created cloud networks often reuse the same private range:
Production account: 10.0.0.0/16<br>Staging account: 10.0.0.0/16<br>Analytics account: 10.0.0.0/16<br>After these networks join one tailnet, an address such as 10.0.0.25 is ambiguous. The destination does not identify its cloud account. Advertising the same route from several Tailscale subnet routers normally means that the routers provide redundant paths to the same subnet; it does not distinguish unrelated networks that happen to reuse an IPv4 range.
Assigned IPv6 Global Unicast prefixes solve this routing conflict because they are globally unique and do not overlap:
Production router -> 2001:db8:100::/64<br>Staging router -> 2001:db8:200::/64<br>Analytics router -> 2001:db8:300::/64<br>Each destination now selects exactly one cloud route. You can connect all the accounts through subnet routers in a single tailnet , keep one identity and access-control layer, and avoid IPv4 renumbering or NAT-based address translation.
one Tailscale tailnet
Developer laptop ─────┬──────────────┬──────────────┐<br>│ │ │<br>prod router staging router analytics router<br>│ │ │<br>unique IPv6 /64 unique IPv6 /64 unique IPv6 /64<br>This property applies to assigned Global Unicast IPv6 space—not every IPv6 address. Do not advertise link-local addresses under fe80::/10. Tailscale’s own node addresses under fd7a:115c:a1e0::/48 are Unique Local Addresses for devices inside the tailnet, not native cloud subnets.
IPv6 uniqueness does not make a workload public by itself. Reachability still depends on Excloud routing, security groups, host firewalls, Tailscale route approval, and tailnet access policy.
What this guide sets up
This guide turns an Ubuntu VM into a Tailscale subnet router. Devices in your tailnet can then reach a native Excloud IPv6 address without installing Tailscale on the target VM.
The example screenshots use 2001:db8:100::/64, a documentation-only prefix. Replace it with your assigned Excloud IPv6 address or prefix.
Advertise a route, not a bare IP. Use /128 to expose one IPv6 host, for example 2001:db8:100::25/128. Use the assigned subnet length, commonly /64, only when the router should provide access to the entire subnet. Do not advertise the router’s Tailscale IPv6 address under fd7a:115c:a1e0::/48.
What you need
An Excloud Ubuntu VM to use as the subnet router.
Network reachability from that VM to the target IPv6 address.
SSH access to the router.
Permission to add a machine and approve routes in your Tailscale tailnet.
The target VM’s native Excloud IPv6 address or subnet prefix.
The router and target can be the same VM for testing, but a subnet router is normally used to reach other machines that do not run Tailscale.
1. Create or choose the router VM
Create an Ubuntu VM in the same Excloud subnet as the target workloads. The managed DEFAULT subnet provides IPv4 and IPv6 connectivity. Follow Deploying Ubuntu if you need a new VM.
SSH to the router and confirm that it has a native global IPv6 address:
ip -6 address show scope global<br>ip -6 route<br>Test the target before installing Tailscale:
ping -6 -c 3 target-ipv6><br>Do not continue until this works. Tailscale cannot repair missing Excloud routes, security-group rules, or host-firewall rules between the router and the target.
2. Install and authenticate Tailscale
On the router, install Tailscale using the official Linux installer:
curl -fsSL https://tailscale.com/install.sh | sh<br>sudo tailscale up --hostname=tailscale-prod-subnet-router<br>The command prints an authentication URL. Open it in a browser, sign in to the correct Tailscale account, and approve the new machine.
For unattended...