Tailscale and a VPN at the same time on Android

Android runs one VPN app at a time, and the Tailscale app is a VPN app. Start NordVPN, Mullvad or Proton VPN and Tailscale disconnects. Start Tailscale and your VPN goes. So you choose: your home network, or your VPN.

un/braid has Tailscale built in, next to its VPN exits. You don’t need the Tailscale app, and you don’t have to switch.

What you can do

• Reach your tailnet while using a VPN. An app routed through un/braid can open your NAS, Home Assistant or a printer at home, while its internet traffic leaves through NordVPN, Mullvad or any other exit.
• Send chosen apps out from home. Give some apps a Tailscale exit node as their exit, such as a computer on your home connection. Other apps keep their VPN exits.
• Use your own control server. Point un/braid at Headscale instead of Tailscale’s servers.

Join your tailnet

1. Open Settings, then Tailscale, and turn on Reach your tailnet.
2. Using Headscale? Open Control server and enter its address, starting with https://. Changing it later signs the phone out of its current tailnet.
3. To sign in without a browser, enter an Auth key (optional) from your admin console in the same place. Saving there stops the VPN for a moment.
4. Connect un/braid from Routes. If Tailscale wants you to sign in, tap Sign in to Tailscale to open the sign-in page in your browser.

The phone then shows up in your tailnet like any other device.

Reach your devices next to a VPN exit

Once you’ve joined, addresses in your tailnet go through Tailscale. Everything else an app does keeps using that app’s exit. So the same app can stream from a VPN exit in another country and open a file on your NAS at home.

Devices behind a subnet router, like a whole home network, need one more step. Open Settings, Local & home access, Home subnets through Tailscale, and add their private IPv4 ranges, such as 192.168.1.0/24. The subnet router must also advertise those routes, and they must be approved in your tailnet.

Send some apps out from home

Create a route and pick a Tailscale exit node as its exit. Apps on that route leave the internet from that node, so sites see your home connection. Your other routes keep their VPN exits.

Two things to know:

• One exit node at a time. All Tailscale routes use the same exit node. You can’t send one app through your home and another through a friend’s node at the same time.
• No automatic failover for exit nodes. If the node goes offline, apps on that route lose internet until it’s back or you change their exit.

Device names with MagicDNS

Names in your tailnet’s own domain, such as nas.tail1234.ts.net or your Headscale base domain, resolve through Tailscale. Once un/braid has learned that domain, Android can also find short names like nas. Apps that use their own DNS may not.

Other DNS zones you set in your tailnet’s DNS settings aren’t added. For those, use the device’s address. Ordinary internet lookups from apps on an exit node go through that node, using Quad9 unless you set your own DNS.

Direct apps and your tailnet

Apps you set to Direct normally skip un/braid, so they skip Tailscale too. If an app needs your home devices, put it on a route.

What has been tested

On Android emulators, with a Headscale tailnet and NordVPN: tailnet devices stayed reachable while NordVPN carried the internet traffic, and one app left through a home exit node. See Tested live for everything we’ve tested, and the split tunneling guide for how routes work.

Questions

Do I still need the Tailscale app? No. un/braid joins your tailnet itself. Android would stop one of them anyway.

Does my tailnet traffic go through the VPN provider? No. Tailnet addresses go through Tailscale, not through the app’s VPN exit.

Does it cost anything? un/braid is free. Tailscale’s own plans and your VPN subscription are separate.