rajsinghtech

HA Subnet Router Site-to-Site Issue & Fix

Date: 2026-01-06 Tailscale Version: v1.92.3 Environment: AWS us-east-1 with VPC Route Server + BIRD BGP

Summary

When using multiple HA subnet routers on both ends of a site-to-site connection, WireGuard drops packets due to incorrect AllowedIPs configuration. The issue stems from Tailscale's HA pairing mechanism not accounting for the fact that underlying network routing (VPC, BGP) doesn't respect these pairings.

rajsinghtech

Running Tailscale in a Network Namespace

Isolate Tailscale to specific interfaces using Linux network namespaces.

Two Approaches

Macvlan (Bare Metal)

Creates virtual interface with its own MAC on the physical NIC. Simpler, no NAT. Best for bare metal where you control the network.