> ## Documentation Index
> Fetch the complete documentation index at: https://docs.replicas.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Start hooks that change networking (VPNs)

> Keep Replicas connected to a workspace when its start hook connects a VPN or adds firewall rules.

Replicas' connection to a workspace comes in over the workspace's network link, `eth0`. If a [start hook](https://docs.replicas.dev/features/environments.md#start-hooks) routes that traffic somewhere else, Replicas can't reach the workspace. After every start hook and [warm hook](https://docs.replicas.dev/features/environments.md#warm-hooks), Replicas checks that it still can. If a start hook cut it off, the run fails and the workspace shows what broke and how to fix it. If a warm hook did, the warm pool build fails with the same explanation, and new workspaces keep starting from the previous snapshot.

Keep `172.31.255.20/30` routed through `eth0`, and allowed by any firewall rules.

## Tailscale

Don't pass `--accept-routes` or `--exit-node` to `tailscale up` if a route in your tailnet covers the range. If you need those routes, stop advertising the overlapping range from your subnet router.

## WireGuard

Leave the range out of `AllowedIPs`. A full tunnel (`AllowedIPs = 0.0.0.0/0`) captures it, so list only the networks you need.

## OpenVPN

Route the range outside the tunnel with `net_gateway`:

```text client.ovpn theme={null}
route 172.31.255.20 255.255.255.252 net_gateway
```

## Firewall rules

Allow the range before any `DROP` or `REJECT` rule:

```bash theme={null}
sudo iptables -I INPUT -s 172.31.255.20/30 -j ACCEPT
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.