Interpret direct and relayed performance

A connection can be correct, encrypted, and slower than you expected. The usual reason is a relay.

Before touching anything, find out which path you are on. Guessing about performance without path information wastes everyone’s time, and it happens all the time.

Read the path

tailscale ping reports whether the peer is reached directly or through a DERP region:

tailscale ping lab-server

pong from lab-server (100.101.9.23) via DERP(fra) in 61ms
pong from lab-server (100.101.9.23) via 203.0.113.40:41641 in 14ms

This output shows an upgrade happening. The first reply relays through Frankfurt at 61ms. Then the direct path finishes negotiating and latency drops to 14ms. If every reply stays on DERP, the peers could not establish a direct route.

tailscale netcheck tells you why:

tailscale netcheck

* UDP: true
* MappingVariesByDestIP: true
* Nearest DERP: Frankfurt

UDP: false means outbound UDP is blocked, so everything relays, full stop. MappingVariesByDestIP: true means a hard NAT: your router gives you a different public port for every destination, which makes direct paths much harder to establish. Both are properties of the network you are on, not of Tailscale.

Interpret before acting

A relay is a designed fallback, not plaintext transport. The payload is WireGuard-encrypted end to end. DERP moves ciphertext it cannot read.

So the question is never “is this insecure?”. The question is “is this fast enough for the workload?”

An SSH session over DERP at 60ms is fine. You will not notice. Nightly multi-gigabyte backups through a relay are not fine. Improve firewall or NAT conditions only when performance justifies the change, typically by allowing outbound UDP or the documented Tailscale port on the stricter network.

Compare two networks

If you can, run the same tailscale ping from home and from a café or office. Note how the same peer can be direct from one and relayed from the other. The path is a property of both networks, not of the tailnet. Nothing changed on the server. Only your side did.

Keep the layers separate

Do not blame the path for application slowness. A slow app on a direct 8ms path is an application problem. A fast app on a 60ms relay may be fine. Measure the path first, then measure the app, and keep the two explanations apart.