diff --git a/ipn/backend.go b/ipn/backend.go
index 96841d93e..0b0f62f93 100644
--- a/ipn/backend.go
+++ b/ipn/backend.go
@@ -39,8 +39,6 @@ type EngineStatus struct {
 	LivePeers      map[tailcfg.NodeKey]wgengine.PeerStatus
 }
 
-type NetworkMap = controlclient.NetworkMap
-
 // Notify is a communication from a backend (e.g. tailscaled) to a frontend
 // (cmd/tailscale, iOS, macOS, Win Tasktray).
 // In any given notification, any or all of these may be nil, meaning
@@ -48,16 +46,16 @@ type NetworkMap = controlclient.NetworkMap
 // They are JSON-encoded on the wire, despite the lack of struct tags.
 type Notify struct {
 	_             structs.Incomparable
-	Version       string           // version number of IPN backend
-	ErrMessage    *string          // critical error message, if any
-	LoginFinished *empty.Message   // event: non-nil when login process succeeded
-	State         *State           // current IPN state has changed
-	Prefs         *Prefs           // preferences were changed
-	NetMap        *NetworkMap      // new netmap received
-	Engine        *EngineStatus    // wireguard engine stats
-	Status        *ipnstate.Status // full status
-	BrowseToURL   *string          // UI should open a browser right now
-	BackendLogID  *string          // public logtail id used by backend
+	Version       string                    // version number of IPN backend
+	ErrMessage    *string                   // critical error message, if any
+	LoginFinished *empty.Message            // event: non-nil when login process succeeded
+	State         *State                    // current IPN state has changed
+	Prefs         *Prefs                    // preferences were changed
+	NetMap        *controlclient.NetworkMap // new netmap received
+	Engine        *EngineStatus             // wireguard engine stats
+	Status        *ipnstate.Status          // full status
+	BrowseToURL   *string                   // UI should open a browser right now
+	BackendLogID  *string                   // public logtail id used by backend
 
 	// type is mirrored in xcode/Shared/IPN.swift
 }
diff --git a/ipn/fake_test.go b/ipn/fake_test.go
index dc9137358..312a75e1c 100644
--- a/ipn/fake_test.go
+++ b/ipn/fake_test.go
@@ -8,6 +8,7 @@ import (
 	"log"
 	"time"
 
+	"tailscale.com/control/controlclient"
 	"tailscale.com/ipn/ipnstate"
 )
 
@@ -44,7 +45,7 @@ func (b *FakeBackend) StartLoginInteractive() {
 	b.newState(NeedsMachineAuth)
 	b.newState(Stopped)
 	// TODO(apenwarr): Fill in a more interesting netmap here.
-	b.notify(Notify{NetMap: &NetworkMap{}})
+	b.notify(Notify{NetMap: &controlclient.NetworkMap{}})
 	b.newState(Starting)
 	// TODO(apenwarr): Fill in a more interesting status.
 	b.notify(Notify{Engine: &EngineStatus{}})
@@ -78,5 +79,5 @@ func (b *FakeBackend) RequestStatus() {
 }
 
 func (b *FakeBackend) FakeExpireAfter(x time.Duration) {
-	b.notify(Notify{NetMap: &NetworkMap{}})
+	b.notify(Notify{NetMap: &controlclient.NetworkMap{}})
 }
diff --git a/ipn/handle.go b/ipn/handle.go
index df3516070..e8d43096f 100644
--- a/ipn/handle.go
+++ b/ipn/handle.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/tailscale/wireguard-go/wgcfg"
+	"tailscale.com/control/controlclient"
 	"tailscale.com/types/logger"
 )
 
@@ -20,7 +21,7 @@ type Handle struct {
 
 	// Mutex protects everything below
 	mu                sync.Mutex
-	netmapCache       *NetworkMap
+	netmapCache       *controlclient.NetworkMap
 	engineStatusCache EngineStatus
 	stateCache        State
 	prefsCache        *Prefs
@@ -127,7 +128,7 @@ func (h *Handle) LocalAddrs() []wgcfg.CIDR {
 	return []wgcfg.CIDR{}
 }
 
-func (h *Handle) NetMap() *NetworkMap {
+func (h *Handle) NetMap() *controlclient.NetworkMap {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
diff --git a/wgengine/filter/filter.go b/wgengine/filter/filter.go
index 03ae539a6..52dcd3275 100644
--- a/wgengine/filter/filter.go
+++ b/wgengine/filter/filter.go
@@ -61,8 +61,8 @@ const (
 )
 
 type tuple struct {
-	SrcIP   IP
-	DstIP   IP
+	SrcIP   packet.IP
+	DstIP   packet.IP
 	SrcPort uint16
 	DstPort uint16
 }
diff --git a/wgengine/filter/filter_test.go b/wgengine/filter/filter_test.go
index ad5cc484b..2eaa3e797 100644
--- a/wgengine/filter/filter_test.go
+++ b/wgengine/filter/filter_test.go
@@ -13,7 +13,9 @@ import (
 	"tailscale.com/wgengine/packet"
 )
 
+// Type aliases only in test code: (but ideally nowhere)
 type QDecode = packet.QDecode
+type IP = packet.IP
 
 var Junk = packet.Junk
 var ICMP = packet.ICMP
diff --git a/wgengine/filter/match.go b/wgengine/filter/match.go
index 651c7f83d..665b1df82 100644
--- a/wgengine/filter/match.go
+++ b/wgengine/filter/match.go
@@ -13,18 +13,16 @@ import (
 	"tailscale.com/wgengine/packet"
 )
 
-type IP = packet.IP
-
-func NewIP(ip net.IP) IP {
+func NewIP(ip net.IP) packet.IP {
 	return packet.NewIP(ip)
 }
 
 type Net struct {
-	IP   IP
-	Mask IP
+	IP   packet.IP
+	Mask packet.IP
 }
 
-func (n Net) Includes(ip IP) bool {
+func (n Net) Includes(ip packet.IP) bool {
 	return (n.IP & n.Mask) == (ip & n.Mask)
 }
 
@@ -44,11 +42,11 @@ func (n Net) String() string {
 }
 
 var NetAny = Net{0, 0}
-var NetNone = Net{^IP(0), ^IP(0)}
+var NetNone = Net{^packet.IP(0), ^packet.IP(0)}
 
-func Netmask(bits int) IP {
+func Netmask(bits int) packet.IP {
 	b := ^uint32((1 << (32 - bits)) - 1)
-	return IP(b)
+	return packet.IP(b)
 }
 
 type PortRange struct {
@@ -126,7 +124,7 @@ func (m Matches) Clone() (res Matches) {
 	return res
 }
 
-func ipInList(ip IP, netlist []Net) bool {
+func ipInList(ip packet.IP, netlist []Net) bool {
 	for _, net := range netlist {
 		if net.Includes(ip) {
 			return true