diff --git a/cmd/derper/bootstrap_dns_test.go b/cmd/derper/bootstrap_dns_test.go
index bd6786558..0a4496f61 100644
--- a/cmd/derper/bootstrap_dns_test.go
+++ b/cmd/derper/bootstrap_dns_test.go
@@ -13,6 +13,7 @@ import (
 	"testing"
 
 	"tailscale.com/tstest"
+	"tailscale.com/tstest/nettest"
 )
 
 func BenchmarkHandleBootstrapDNS(b *testing.B) {
@@ -55,6 +56,8 @@ func getBootstrapDNS(t *testing.T, q string) dnsEntryMap {
 }
 
 func TestUnpublishedDNS(t *testing.T) {
+	nettest.SkipIfNoNetwork(t)
+
 	const published = "login.tailscale.com"
 	const unpublished = "log.tailscale.io"
 
diff --git a/tstest/nettest/nettest.go b/tstest/nettest/nettest.go
new file mode 100644
index 000000000..47c8857a5
--- /dev/null
+++ b/tstest/nettest/nettest.go
@@ -0,0 +1,21 @@
+// Copyright (c) Tailscale Inc & AUTHORS
+// SPDX-License-Identifier: BSD-3-Clause
+
+// Package nettest contains additional test helpers related to network state
+// that can't go into tstest for circular dependency reasons.
+package nettest
+
+import (
+	"testing"
+
+	"tailscale.com/net/netmon"
+)
+
+// SkipIfNoNetwork skips the test if it looks like there's no network
+// access.
+func SkipIfNoNetwork(t testing.TB) {
+	nm := netmon.NewStatic()
+	if !nm.InterfaceState().AnyInterfaceUp() {
+		t.Skip("skipping; test requires network but no interface is up")
+	}
+}