diff --git a/android/src/main/java/com/tailscale/ipn/IPNService.java b/android/src/main/java/com/tailscale/ipn/IPNService.java
index b5bbe9e..e2b0d1d 100644
--- a/android/src/main/java/com/tailscale/ipn/IPNService.java
+++ b/android/src/main/java/com/tailscale/ipn/IPNService.java
@@ -9,6 +9,7 @@ import android.app.PendingIntent;
 import android.app.NotificationChannel;
 import android.content.Intent;
 import android.net.VpnService;
+import android.system.OsConstants;
 
 import org.gioui.GioActivity;
 
@@ -56,7 +57,10 @@ public class IPNService extends VpnService {
 	}
 
 	protected VpnService.Builder newBuilder() {
-		return new VpnService.Builder().setConfigureIntent(configIntent());
+		return new VpnService.Builder()
+			.setConfigureIntent(configIntent())
+			.allowFamily(OsConstants.AF_INET)
+			.allowFamily(OsConstants.AF_INET6);
 	}
 
 	public void notify(String title, String message) {
diff --git a/cmd/tailscale/backend.go b/cmd/tailscale/backend.go
index 8e68a98..dd68e04 100644
--- a/cmd/tailscale/backend.go
+++ b/cmd/tailscale/backend.go
@@ -135,6 +135,8 @@ func (b *backend) updateTUN(service jni.Object, cfg *router.Config) error {
 	}
 	err := jni.Do(b.jvm, func(env jni.Env) error {
 		cls := jni.GetObjectClass(env, service)
+		// Construct a VPNService.Builder. IPNService.newBuilder calls
+		// setConfigureIntent, and allowFamily for both IPv4 and IPv6.
 		m := jni.GetMethodID(env, cls, "newBuilder", "()Landroid/net/VpnService$Builder;")
 		builder, err := jni.CallObjectMethod(env, service, m)
 		if err != nil {