TROUBLESHOOTING

Tailscale Stuck on Relay? How to Get a Direct Connection

If your Tailscale relay slow direct connection problem sounds like "everything works, but it's painfully sluggish," you're probably stuck…

✓How to Tell You're on a DERP✓Why Tailscale Falls Back to Relays✓Enabling UPnP/NAT-PMP and Opening

Quick Answer

A Tailscale connection stuck on a DERP relay still works, but the detour adds latency and cuts throughput. The fix is usually direct UDP: enable UPnP or NAT-PMP on the home router (or forward UDP 41641) and confirm neither device is behind CGNAT. HomeIPVPN verifies direct paths during every setup.

Diagnose: tailscale status and tailscale ping show whether each peer connects directly or via a DERP relay.
Fix: UPnP/NAT-PMP on the home router, or a manual forward of UDP 41641, restores direct WireGuard connections.
CGNAT check: If both ends sit behind carrier-grade NAT with no forwarding possible, the relay is the only path. Accept the slower speed.
Symptoms: File transfers crawl, remote desktop lags, and video calls stutter while raw bandwidth tests look fine.

Tailscale Stuck on Relay? How to Get a Direct Connection

If your Tailscale relay slow direct connection problem sounds like "everything works, but it's painfully sluggish," you're probably stuck on a DERP relay instead of a direct peer-to-peer connection. Tailscale is built to punch through NAT and connect your devices directly, but when it can't, it quietly falls back to relaying traffic through Tailscale's DERP servers. That fallback is reliable but slow.

A direct connection is fast because traffic takes the shortest path. A relayed connection detours through a DERP server, adding latency and cutting throughput, sometimes turning video calls into slideshows. The good news: in most home setups, getting off the relay takes a few configuration tweaks.

> Quick answer: If Tailscale is stuck on a DERP relay and feels slow, the fix is usually enabling direct UDP connectivity. Check connection status with tailscale status, enable UPnP or NAT-PMP on your home router (or forward UDP port 41641), and confirm neither device is behind CGNAT. Direct WireGuard connections typically restore full speed; if both ends are behind carrier-grade NAT with no port forwarding possible, Tailscale's relay still works: it's just slower.

How to Tell You're on a DERP Relay

The fastest diagnostic is the Tailscale CLI. Run tailscale status on one of your devices. In the output, each peer shows how it's connected. If you see a peer connected via a DERP relay (something like "relay" next to the peer name, or relay-related text in tailscale ping output), that's your confirmation.

A more decisive test is tailscale ping <peer>, which reports whether the path is direct or relayed. If it shows DERP relay usage while both devices are on decent networks, you've got NAT traversal trouble rather than a bandwidth problem.

Real-world symptoms of a relayed connection include:

File transfers between your laptop and home devices crawl at a fraction of your internet speed
Remote desktop or SSH sessions feel laggy with noticeable input delay
Video calls drop in quality even though your raw bandwidth tests look fine
Latency to a peer is suspiciously high compared to pinging a public server nearby

Keep in mind that a relay isn't always the wrong answer, it's a deliberate fallback. But if you control both ends, it's worth trying to eliminate.

Why Tailscale Falls Back to Relays

Tailscale's whole design goal is direct WireGuard connections between your devices. It uses NAT traversal techniques (mostly "hole punching" with STUN-style tricks) to connect peers even when both sit behind ordinary home routers. DERP (Designated Encrypted Relay for Packets) servers exist as a guaranteed fallback when hole punching fails.

The common reasons hole punching fails:

Carrier-grade NAT (CGNAT). Many ISPs, especially mobile carriers and some fiber providers, put customers behind CGNAT, so your router never gets a public IPv4 address. Without a public address to punch toward, direct UDP connections are far harder.
Strict or symmetric NAT. Some routers assign different external ports per destination (symmetric NAT), which defeats hole punching.
UDP blocked or filtered. Corporate firewalls, hotel WiFi, and some ISPs block or throttle UDP outright, or block the ports Tailscale prefers.
No UPnP/NAT-PMP and no manual port forward. Tailscale can work without them, but their absence makes direct connections less likely.

Tailscale prefers DERP relaying silently over failing loudly, so you can use it for months without realizing you never had a direct connection.

Enabling UPnP/NAT-PMP and Opening UDP 41641

The single most effective fix for a home device is giving Tailscale a way to receive inbound UDP. Two approaches:

Option 1: Enable UPnP or NAT-PMP on your home router

Tailscale's client automatically tries UPnP and NAT-PMP to request a port mapping from your router. Many routers ship with UPnP off by default.

Log into your home router's admin page (often 192.168.1.1 or 192.168.0.1).
Find the UPnP setting (sometimes under NAT, advanced, or firewall settings) and turn it on. Enable NAT-PMP if it's listed separately.
Save and restart the Tailscale client on the home device, or reboot the device.
Run tailscale ping between your devices and check whether the connection is now direct.

One caveat: security-conscious users sometimes keep UPnP off deliberately, since it lets any device on your LAN open inbound ports. That's a fair concern, Option 2 is the more controlled alternative.

Option 2: Manually forward UDP port 41641

Tailscale listens on UDP port 41641 by default. Forwarding that port to your home device gives inbound WireGuard packets a fixed destination.

In your router's port forwarding settings, create a rule: external UDP port 41641 → your Tailscale device's LAN IP, port 41641.
Give that device a static DHCP reservation so its LAN IP doesn't change.
Restart Tailscale on the device and re-test with tailscale ping.

If you're on CGNAT

Check your router's WAN IP against your public IP (search "what is my IP"). If the router's WAN address is in the 100.64.0.0/10 range, you're behind CGNAT, and port forwarding at your router won't help: the carrier's NAT sits upstream.

Options when CGNAT blocks inbound connections:

Ask your ISP for a public IPv4 address (some offer it on request, occasionally as a paid add-on).
If your ISP offers IPv6, enable it. Tailscale can use IPv6 paths directly, and IPv6 generally has no CGNAT.
Accept the DERP relay as a fallback and optimize what you can (see below).

When Relay Is Unavoidable, and How to Live with It

Sometimes a relay genuinely is the best available path: both devices behind CGNAT, restrictive hotel WiFi, or a corporate network you don't control. In that case, the goal shifts from eliminating the relay to squeezing the most out of it.

Strategy	What it does
Pick the nearest DERP region	Tailscale selects automatically, but reviewing with `tailscale netcheck` confirms you're hitting the closest relay
Use `tailscale ping` periodically	Relay routing can degrade; a fresh ping shows whether the path has changed
Shift heavy traffic to off-peak	Relays are shared infrastructure; large transfers go faster outside peak hours
Consider an exit node on a VPS	A VPS with a public IP gives you a stable, publicly reachable hop your devices can reach directly

Also note that relay performance isn't uniform: text SSH and light browsing feel nearly identical on a relay, while bulk file copies and 4K streaming suffer most.

FAQ

Does Tailscale's DERP relay slow down my connection? +

Yes, compared to a direct connection. Relayed traffic travels to a DERP server and back, which adds latency and caps throughput below what a direct WireGuard tunnel delivers. The encryption is the same either way (your data stays encrypted end to end), but the extra hops cost speed.

How do I check if my Tailscale connection is relayed or direct? +

Run tailscale status to see peer connection states, then tailscale ping <peer> for a detailed latency report that shows whether the path is direct or going through a DERP relay. Run tailscale netcheck to see your NAT type and which DERP region you're closest to.

What port does Tailscale use for direct connections? +

UDP port 41641 by default. Manually forwarding that port from your router to your Tailscale device is one of the most reliable ways to get direct connections, especially when UPnP is disabled.

Will a relay ever be as fast as a direct connection? +

Sometimes, if the DERP region is close and the direct path is congested. But in general, a direct peer-to-peer WireGuard connection is faster and has lower latency than any relayed path.

Can I force Tailscale to never use a relay? +

There's no supported "disable relays" switch for everyday use, because relays are the connectivity guarantee. The practical approach is to make direct connections easy (port forwarding, public IP, IPv6) so Tailscale prefers them automatically.

Is my traffic less secure on a DERP relay? +

No. DERP relays forward encrypted WireGuard packets; the relay server can't read your traffic. Security is the same, only speed differs.

Need help setting this up?

Still stuck on a relay after working through the steps above? A $79 consultation can pin down whether it's CGNAT, a router setting, or something stranger: https://homeipvpn.com/appointment. Consultations run remotely via remote desktop at your scheduled appointment, and the $79 counts toward the $379 Secure Home IP VPN System session.

Tailscale Stuck on Relay? How to Get a Direct Connection