eth0. If a start hook routes that traffic somewhere else, Replicas can’t reach the workspace. After every start hook and warm hook, Replicas checks that it still can. If a start hook cut it off, the run fails and the workspace shows what broke and how to fix it. If a warm hook did, the warm pool build fails with the same explanation, and new workspaces keep starting from the previous snapshot.
Keep 172.31.255.20/30 routed through eth0, and allowed by any firewall rules.
Tailscale
Don’t pass--accept-routes or --exit-node to tailscale up if a route in your tailnet covers the range. If you need those routes, stop advertising the overlapping range from your subnet router.
WireGuard
Leave the range out ofAllowedIPs. A full tunnel (AllowedIPs = 0.0.0.0/0) captures it, so list only the networks you need.
OpenVPN
Route the range outside the tunnel withnet_gateway:
client.ovpn
Firewall rules
Allow the range before anyDROP or REJECT rule: