diff --git a/cmd/derper/derper.go b/cmd/derper/derper.go
index 39efd19a7..758b27d0e 100644
--- a/cmd/derper/derper.go
+++ b/cmd/derper/derper.go
@@ -29,7 +29,7 @@ import (
 	"tailscale.com/derp/derphttp"
 	"tailscale.com/logpolicy"
 	"tailscale.com/metrics"
-	"tailscale.com/stun"
+	"tailscale.com/net/stun"
 	"tailscale.com/tsweb"
 	"tailscale.com/types/key"
 )
diff --git a/cmd/tailscale/netcheck.go b/cmd/tailscale/netcheck.go
index 7de01f72a..6fab16193 100644
--- a/cmd/tailscale/netcheck.go
+++ b/cmd/tailscale/netcheck.go
@@ -14,7 +14,7 @@ import (
 	"github.com/peterbourgon/ff/v2/ffcli"
 	"tailscale.com/derp/derpmap"
 	"tailscale.com/net/dnscache"
-	"tailscale.com/netcheck"
+	"tailscale.com/net/netcheck"
 	"tailscale.com/types/logger"
 )
 
diff --git a/netcheck/netcheck.go b/net/netcheck/netcheck.go
similarity index 99%
rename from netcheck/netcheck.go
rename to net/netcheck/netcheck.go
index f74bae5ec..72df18328 100644
--- a/netcheck/netcheck.go
+++ b/net/netcheck/netcheck.go
@@ -23,7 +23,7 @@ import (
 	"inet.af/netaddr"
 	"tailscale.com/net/dnscache"
 	"tailscale.com/net/interfaces"
-	"tailscale.com/stun"
+	"tailscale.com/net/stun"
 	"tailscale.com/syncs"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logger"
diff --git a/netcheck/netcheck_test.go b/net/netcheck/netcheck_test.go
similarity index 99%
rename from netcheck/netcheck_test.go
rename to net/netcheck/netcheck_test.go
index 58a4eef74..1a6fa5a00 100644
--- a/netcheck/netcheck_test.go
+++ b/net/netcheck/netcheck_test.go
@@ -15,8 +15,8 @@ import (
 	"testing"
 	"time"
 
-	"tailscale.com/stun"
-	"tailscale.com/stun/stuntest"
+	"tailscale.com/net/stun"
+	"tailscale.com/net/stun/stuntest"
 	"tailscale.com/tailcfg"
 )
 
diff --git a/stun/stun.go b/net/stun/stun.go
similarity index 100%
rename from stun/stun.go
rename to net/stun/stun.go
diff --git a/stun/stun_test.go b/net/stun/stun_test.go
similarity index 99%
rename from stun/stun_test.go
rename to net/stun/stun_test.go
index d422c15c4..09ea900c1 100644
--- a/stun/stun_test.go
+++ b/net/stun/stun_test.go
@@ -10,7 +10,7 @@ import (
 	"net"
 	"testing"
 
-	"tailscale.com/stun"
+	"tailscale.com/net/stun"
 )
 
 // TODO(bradfitz): fuzz this.
diff --git a/stun/stuntest/stuntest.go b/net/stun/stuntest/stuntest.go
similarity index 99%
rename from stun/stuntest/stuntest.go
rename to net/stun/stuntest/stuntest.go
index b53db0e0a..c2e462f78 100644
--- a/stun/stuntest/stuntest.go
+++ b/net/stun/stuntest/stuntest.go
@@ -14,7 +14,7 @@ import (
 	"testing"
 
 	"inet.af/netaddr"
-	"tailscale.com/stun"
+	"tailscale.com/net/stun"
 	"tailscale.com/tailcfg"
 )
 
diff --git a/wgengine/magicsock/magicsock.go b/wgengine/magicsock/magicsock.go
index 1b8cb0cc4..29be2233e 100644
--- a/wgengine/magicsock/magicsock.go
+++ b/wgengine/magicsock/magicsock.go
@@ -35,8 +35,8 @@ import (
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/net/dnscache"
 	"tailscale.com/net/interfaces"
-	"tailscale.com/netcheck"
-	"tailscale.com/stun"
+	"tailscale.com/net/netcheck"
+	"tailscale.com/net/stun"
 	"tailscale.com/syncs"
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
diff --git a/wgengine/magicsock/magicsock_test.go b/wgengine/magicsock/magicsock_test.go
index 992768adc..859fb5b00 100644
--- a/wgengine/magicsock/magicsock_test.go
+++ b/wgengine/magicsock/magicsock_test.go
@@ -26,7 +26,7 @@ import (
 	"tailscale.com/derp"
 	"tailscale.com/derp/derphttp"
 	"tailscale.com/derp/derpmap"
-	"tailscale.com/stun/stuntest"
+	"tailscale.com/net/stun/stuntest"
 	"tailscale.com/tailcfg"
 	"tailscale.com/tstest"
 	"tailscale.com/types/key"