Tailscale and NordVPN at the same time on Android

The NordVPN app and the Tailscale app can’t be connected together on Android. Android allows one VPN app per profile, so connecting one normally disconnects the other. You end up switching between your home network and NordVPN.

unbraid signs in to NordVPN and has Tailscale built in. Your apps use a NordVPN exit for the internet and reach your tailnet devices at the same time.

Set it up

1. Get a NordVPN access token. In your Nord Account, open NordVPN, Manual setup, and generate a new token.
2. Add NordVPN. In unbraid, go to Settings, Providers & servers, Add connection, and choose NordVPN. Paste the token and tap Continue. On a fresh install, the first run asks for a connection.
3. Choose your exit. In Routes, open the default route and tap Change location. Select NordVPN under Provider, choose NordLynx, OpenVPN UDP or OpenVPN TCP under Protocol, then select a country or city. If Direct is your default, tap +, then Route instead, pick the location, then open the new route and tap Make default.
4. Join your tailnet. Open Settings, Tailscale, and turn on Reach your tailnet. If you use Headscale, open Control server, enter its https:// address and tap Save. Saving it stops unbraid and resets its Tailscale sign-in.
5. Connect from Routes. If Tailscale asks you to sign in, tap Sign in to Tailscale.

The phone then shows up in your tailnet like any other device. If NordVPN or Tailscale is set as Android’s Always-on VPN, turn that off first, or choose unbraid instead.

What goes where

• Internet traffic from routed apps leaves through NordVPN.
• Tailnet addresses go through Tailscale, not through NordVPN. Your NAS or Home Assistant stays reachable.
• Names in your tailnet’s domain, such as nas.tail1234.ts.net, resolve through Tailscale.
• Other lookups on NordVPN routes use NordVPN’s DNS, with Threat Protection Lite on by default. Switch it off under Settings, DNS & filtering. A custom DNS server there replaces NordVPN’s DNS for all VPN routes. Android’s Private DNS, and apps with their own encrypted DNS, can bypass both.
• Apps you set to Direct, with NordVPN as the default route, bypass unbraid and its Tailscale connection unless Android’s Block connections without VPN is on. Put an app on a NordVPN route if it needs your tailnet.

To reach devices behind a subnet router, like your whole home network, add their private IPv4 ranges under Settings, Local & home access, Home subnets through Tailscale. The subnet router must advertise those ranges, and they must be approved in your tailnet.

More than one NordVPN country

Add a route with another NordVPN location and assign apps to it. A streaming app can use the United States while the rest use the Netherlands, and both reach your tailnet. Routes on the same server with the same settings share one connection. NordVPN’s limit on simultaneous connections still applies.

For a Dedicated IP or Double VPN, open Route options in the location picker, choose a Server type, then select a location. A Dedicated IP must be on your NordVPN account. Double VPN uses OpenVPN.

Some apps through your home

A Tailscale exit node can be a route’s exit too. Put your banking app on your home connection while everything else uses NordVPN. See a Tailscale exit node for some apps.

What we tested

We tested tailnet access next to NordVPN on Android emulators with a Headscale tailnet.

Questions

Do I need the NordVPN or Tailscale app? No. unbraid connects to both itself. Android would disconnect one of them anyway.

Does NordVPN see my tailnet traffic? No. Tailnet addresses go through Tailscale.

What about Meshnet? unbraid doesn’t use NordVPN’s Meshnet. Tailscale covers reaching your own devices.

Does it cost anything? unbraid is free and open source. Your NordVPN subscription and Tailscale plan are separate.