diff --git a/cmd/tailscaled/depaware.txt b/cmd/tailscaled/depaware.txt
index cf2763092..12aad21d2 100644
--- a/cmd/tailscaled/depaware.txt
+++ b/cmd/tailscaled/depaware.txt
@@ -105,7 +105,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/net/tlsdial                                    from tailscale.com/control/controlclient+
         tailscale.com/net/tsaddr                                     from tailscale.com/ipn/ipnlocal+
      💣 tailscale.com/net/tshttpproxy                                from tailscale.com/control/controlclient+
-        tailscale.com/net/tun                                        from tailscale.com/cmd/tailscaled
+        tailscale.com/net/tstun                                      from tailscale.com/cmd/tailscaled
         tailscale.com/paths                                          from tailscale.com/cmd/tailscaled+
         tailscale.com/portlist                                       from tailscale.com/ipn/ipnlocal
         tailscale.com/safesocket                                     from tailscale.com/ipn/ipnserver
diff --git a/cmd/tailscaled/tailscaled.go b/cmd/tailscaled/tailscaled.go
index 522fcf042..137ccb61c 100644
--- a/cmd/tailscaled/tailscaled.go
+++ b/cmd/tailscaled/tailscaled.go
@@ -32,7 +32,7 @@ import (
 	"tailscale.com/ipn/ipnserver"
 	"tailscale.com/logpolicy"
 	"tailscale.com/net/socks5"
-	"tailscale.com/net/tun"
+	ntun "tailscale.com/net/tstun"
 	"tailscale.com/paths"
 	"tailscale.com/types/flagtype"
 	"tailscale.com/types/logger"
@@ -337,9 +337,9 @@ func tryEngine(logf logger.Logf, linkMon *monitor.Mon, name string) (e wgengine.
 		conf.TUN = tstun.NewFakeTUN()
 		conf.Router = router.NewFake(logf)
 	} else {
-		dev, err := tun.New(logf, name)
+		dev, err := ntun.New(logf, name)
 		if err != nil {
-			tun.Diagnose(logf, name)
+			ntun.Diagnose(logf, name)
 			return nil, false, err
 		}
 		conf.TUN = dev
diff --git a/cmd/tailscaled/tailscaled_windows.go b/cmd/tailscaled/tailscaled_windows.go
index fa7f5e760..fbd760950 100644
--- a/cmd/tailscaled/tailscaled_windows.go
+++ b/cmd/tailscaled/tailscaled_windows.go
@@ -30,7 +30,7 @@ import (
 	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 	"tailscale.com/ipn/ipnserver"
 	"tailscale.com/logpolicy"
-	"tailscale.com/net/tun"
+	"tailscale.com/net/tstun"
 	"tailscale.com/tempfork/wireguard-windows/firewall"
 	"tailscale.com/types/logger"
 	"tailscale.com/version"
@@ -160,7 +160,7 @@ func startIPNServer(ctx context.Context, logid string) error {
 	var err error
 
 	getEngine := func() (wgengine.Engine, error) {
-		dev, err := tun.New(logf, "Tailscale")
+		dev, err := tstun.New(logf, "Tailscale")
 		if err != nil {
 			return nil, err
 		}
diff --git a/net/tun/ifstatus_noop.go b/net/tstun/ifstatus_noop.go
similarity index 96%
rename from net/tun/ifstatus_noop.go
rename to net/tstun/ifstatus_noop.go
index e40c8c15e..223be7949 100644
--- a/net/tun/ifstatus_noop.go
+++ b/net/tstun/ifstatus_noop.go
@@ -4,7 +4,7 @@
 
 // +build !windows
 
-package tun
+package tstun
 
 import (
 	"time"
diff --git a/net/tun/ifstatus_windows.go b/net/tstun/ifstatus_windows.go
similarity index 99%
rename from net/tun/ifstatus_windows.go
rename to net/tstun/ifstatus_windows.go
index d5b05ff40..840e50f4d 100644
--- a/net/tun/ifstatus_windows.go
+++ b/net/tstun/ifstatus_windows.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package tun
+package tstun
 
 import (
 	"fmt"
diff --git a/net/tun/tun.go b/net/tstun/tun.go
similarity index 99%
rename from net/tun/tun.go
rename to net/tstun/tun.go
index 61f10ad76..6750912f6 100644
--- a/net/tun/tun.go
+++ b/net/tstun/tun.go
@@ -4,7 +4,7 @@
 
 // Package tun creates a tuntap device, working around OS-specific
 // quirks if necessary.
-package tun
+package tstun
 
 import (
 	"bytes"