Operate and choose
Interpret direct and relayed performance
Use path information and network checks to explain latency or throughput without treating every DERP connection as a security failure.
8 minute lesson
A connection can be correct and encrypted while performing worse than expected because it uses a relay.
Before touching anything, find out which path you are on. Guessing about performance without path information wastes everyone’s time.
Read the path
tailscale ping reports whether the peer is reached directly or through a DERP region:
tailscale ping lab-serverpong from lab-server (100.101.9.23) via DERP(fra) in 61ms
pong from lab-server (100.101.9.23) via 203.0.113.40:41641 in 14msThis output shows an upgrade happening: the first reply relays through Frankfurt, then the direct path finishes negotiating and latency drops. If every reply stays on DERP, the peers could not establish a direct route.
tailscale netcheck helps reveal UDP and mapping behavior:
tailscale netcheck* UDP: true
* MappingVariesByDestIP: true
* Nearest DERP: FrankfurtUDP: false means outbound UDP is blocked, so everything relays, full stop. MappingVariesByDestIP: true indicates a hard NAT, which makes direct paths much harder to establish.
Interpret before acting
A relay is a designed fallback, not plaintext transport. The payload is WireGuard-encrypted end to end; DERP moves ciphertext it cannot read. So the question is never “is this insecure?”. The question is “is this fast enough for the workload?”
An SSH session over DERP at 60ms is fine. Nightly multi-gigabyte backups through a relay are not. Improve firewall or NAT conditions only when performance justifies the change, typically by allowing outbound UDP or the documented Tailscale port on the stricter network.
Compare two networks
Compare path, latency, and transfer behavior on two networks if available. Run the same tailscale ping from home and from a café, and note how the same peer can be direct from one and relayed from the other. The path is a property of both networks, not of the tailnet.
Keep the explanation separate from assumptions about application speed. A slow app on a direct 8ms path is an application problem. Measure first.
Lesson completed